CVE-2017-10074
HighSummary
Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE that allows an unauthenticated attacker with network access to compromise these systems. It requires human interaction, making exploitation difficult.
Risk Assessment
Successful attacks can result in takeover of Java SE and Java SE Embedded, which may significantly impact additional products relying on these technologies.
Recommendation
It is recommended to update to the latest versions of Java SE and Java SE Embedded to minimize the risk associated with this vulnerability.
Other vulnerabilities in Java SE, Java SE Embedded
See all- CVE-2017-10388High
Vulnerability in the Java SE and Java SE Embedded components allows an unauthenticated attacker with network access via Kerberos to compromise these systems. Human interaction is required, making exploitation difficult.
- CVE-2016-0494High
An unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
- CVE-2017-10346Critical
A vulnerability in the Java SE and Java SE Embedded components allows easy exploitation by an unauthenticated attacker with network access. It requires human interaction, which may lead to the takeover of Java SE or Java SE Embedded.
- CVE-2017-10285Critical
Vulnerability in the Java SE and Java SE Embedded components of Oracle Java SE, related to RMI, allows an unauthenticated attacker with network access to compromise these systems. Attacks require human interaction, which may lead to takeover of Java SE and Java SE Embedded.
- CVE-2017-10111Critical
Vulnerability in the Java SE and Java SE Embedded components of Oracle Java SE, affecting version 8u131. Easily exploitable by an unauthenticated attacker with network access, potentially leading to takeover of Java SE and Java SE Embedded.
- CVE-2017-10107Critical
Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE, affecting the RMI subcomponent. It allows easy exploitation by an unauthenticated attacker with network access, potentially leading to takeover of Java SE and Java SE Embedded.
- CVE-2017-10102Critical
Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE, concerning RMI, allows an unauthenticated attacker with network access to compromise these systems. The attacker can exploit this vulnerability by supplying data to APIs in the specified component.
- CVE-2017-10101Critical
Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) allows an unauthenticated attacker with network access to compromise these systems. It requires human interaction, making attacks potentially impactful on additional products.
- CVE-2017-10096Critical
Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) allows an unauthenticated attacker with network access to compromise these systems. Successful attacks require human interaction, making them easy to execute under the right conditions.
- CVE-2017-10090Critical
A vulnerability in the Java SE and Java SE Embedded components allows easy exploitation by an unauthenticated attacker with network access. It requires human interaction, which may lead to the takeover of Java SE and Java SE Embedded.
Original NVD description (English source)
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and r