CVE-2017-3261: Integer Overflow
An integer overflow flaw, leading to a buffer over-read, was found in the array boundary checks in SocketOutputStream and SocketInputStream in the Networking component of OpenJDK. An untrusted Java application or applet could use this flaw to disclose portions of the Java virtual machine memory and therefore bypass certain Java sandbox restrictions.
Other sources
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 4.3 (Confidentiality impacts).
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-8to a version that resolves this vulnerability.Fixed in 8u442-ga-2 - Upgrade
Upgrade
Oracle Java SE (subcomponent: Networking)to a version that resolves this vulnerability.Fixed in 6u131 - Upgrade
Upgrade
Oracle Java SE (subcomponent: Networking)to a version that resolves this vulnerability.Fixed in 7u121 - Upgrade
Upgrade
Oracle Java SE (subcomponent: Networking)to a version that resolves this vulnerability.Fixed in 8u112 - Upgrade
Upgrade
Oracle Java SE Embedded (subcomponent: Networking)to a version that resolves this vulnerability.Fixed in 8u111
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3261?
CVE-2017-3261 is considered to have a medium severity level due to its potential for information disclosure.
How do I fix CVE-2017-3261?
To fix CVE-2017-3261, update to the recommended patched versions of the impacted Oracle JDK or JRE.
What versions are affected by CVE-2017-3261?
CVE-2017-3261 affects Oracle JDK versions 1.6-update_131, 1.7-update_121, and 1.8-update_111 and 1.8-update_112 as well as the corresponding JRE versions.
What type of vulnerability is CVE-2017-3261?
CVE-2017-3261 is an integer overflow vulnerability that can lead to a buffer over-read.
Can CVE-2017-3261 be exploited remotely?
CVE-2017-3261 can be exploited by an untrusted Java application or applet, potentially allowing remote information disclosure.