CVE-2017-3253
First published: Mon Jan 16 2017(Updated: )
It was discovered that the PNGImageReader in the javax.imageio package of the 2D component of OpenJDK performed parsing of iTXt and zTXt PNG image chunks even when ignoreMetadata was set to true. An attacker able to make a Java application parse a specially crafted PNG image could cause the application to consume an excessive amount of memory.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle JDK 6 | =1.6-update_131 | |
| Oracle JDK 6 | =1.7-update_121 | |
| Oracle JDK 6 | =1.8-update_111 | |
| Oracle JDK 6 | =1.8-update_112 | |
| Oracle Java Runtime Environment (JRE) | =1.6-update_131 | |
| Oracle Java Runtime Environment (JRE) | =1.7-update_121 | |
| Oracle Java Runtime Environment (JRE) | =1.8-update_111 | |
| Oracle Java Runtime Environment (JRE) | =1.8-update_112 | |
| BEA JRockit | =r28.3.12 | |
| debian/openjdk-8 | 8u442-ga-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rhn.redhat.com/errata/RHSA-2017-0175.html
- http://rhn.redhat.com/errata/RHSA-2017-0176.html
- http://rhn.redhat.com/errata/RHSA-2017-0177.html
- http://rhn.redhat.com/errata/RHSA-2017-0180.html
- http://rhn.redhat.com/errata/RHSA-2017-0263.html
- http://rhn.redhat.com/errata/RHSA-2017-0269.html
- http://rhn.redhat.com/errata/RHSA-2017-0336.html
- http://rhn.redhat.com/errata/RHSA-2017-0337.html
- http://rhn.redhat.com/errata/RHSA-2017-0338.html
- http://www.debian.org/security/2017/dsa-3782
- http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html
- http://www.securityfocus.com/bid/95498
- http://www.securitytracker.com/id/1037637
- https://access.redhat.com/errata/RHSA-2017:1216
- https://security.gentoo.org/glsa/201701-65
- https://security.gentoo.org/glsa/201707-01
- https://security.netapp.com/advisory/ntap-20170119-0001/
- https://launchpad.net/bugs/cve/CVE-2017-3253
- http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixJAVA
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/b59238f0e161
- https://rhn.redhat.com/errata/RHSA-2017-0176.html
- https://rhn.redhat.com/errata/RHSA-2017-0175.html
- https://rhn.redhat.com/errata/RHSA-2017-0177.html
- https://rhn.redhat.com/errata/RHSA-2017-0180.html
- https://rhn.redhat.com/errata/RHSA-2017-0263.html
- https://rhn.redhat.com/errata/RHSA-2017-0269.html
- https://rhn.redhat.com/errata/RHSA-2017-0337.html
- https://rhn.redhat.com/errata/RHSA-2017-0336.html
- https://rhn.redhat.com/errata/RHSA-2017-0338.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1413583
- https://security-tracker.debian.org/tracker/CVE-2017-3253
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3253
- https://nvd.nist.gov/vuln/detail/CVE-2017-3253
- https://ubuntu.com/security/CVE-2017-3253
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-3253
- agent/author
- agent/remedy
- agent/severity
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- package-manager/debian
- vendor/oracle
- canonical/oracle jdk 6
- version/oracle jdk 6/1.6-update_131
- version/oracle jdk 6/1.7-update_121
- version/oracle jdk 6/1.8-update_111
- version/oracle jdk 6/1.8-update_112
- canonical/oracle java runtime environment (jre)
- version/oracle java runtime environment (jre)/1.6-update_131
- version/oracle java runtime environment (jre)/1.7-update_121
- version/oracle java runtime environment (jre)/1.8-update_111
- version/oracle java runtime environment (jre)/1.8-update_112
- canonical/bea jrockit
- version/bea jrockit/r28.3.12