CVE-2017-3261

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 4.3 (Confidentiality impacts).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
oracleCNA
---
---
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
VendorProductVersion
oraclejdk
1.6
oraclejdk
1.7
oraclejdk
1.8
oraclejdk
1.8
oraclejre
1.6
oraclejre
1.7
oraclejre
1.8
oraclejre
1.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openjdk-8
sid
8u432-b06-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openjdk-6
yakkety
dne
xenial
dne
trusty
Fixed 6b41-1.13.13-0ubuntu0.14.04.1
released
precise
Fixed 6b41-1.13.13-0ubuntu0.12.04.1
released
openjdk-7
yakkety
dne
xenial
dne
trusty
Fixed 7u121-2.6.8-1ubuntu0.14.04.3
released
precise
Fixed 7u121-2.6.8-1ubuntu0.12.04.3
released
openjdk-8
yakkety
Fixed 8u121-b13-0ubuntu1.16.10.2
released
xenial
Fixed 8u121-b13-0ubuntu1.16.04.2
released
trusty
dne
precise
dne
References