CVE-2017-10388
HighSummary
Vulnerability in the Java SE and Java SE Embedded components allows an unauthenticated attacker with network access via Kerberos to compromise these systems. Human interaction is required, making exploitation difficult.
Risk Assessment
An attacker could take control of Java SE and Java SE Embedded, potentially leading to serious breaches of confidentiality, integrity, and availability of data.
Recommendation
It is recommended to update to the latest versions of Java SE and Java SE Embedded to minimize the risk associated with this vulnerability.
Other vulnerabilities in Java SE, Java SE Embedded
See all- CVE-2017-10074High
Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE that allows an unauthenticated attacker with network access to compromise these systems. It requires human interaction, making exploitation difficult.
- CVE-2016-0494High
An unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
- CVE-2017-10346Critical
A vulnerability in the Java SE and Java SE Embedded components allows easy exploitation by an unauthenticated attacker with network access. It requires human interaction, which may lead to the takeover of Java SE or Java SE Embedded.
- CVE-2017-10285Critical
Vulnerability in the Java SE and Java SE Embedded components of Oracle Java SE, related to RMI, allows an unauthenticated attacker with network access to compromise these systems. Attacks require human interaction, which may lead to takeover of Java SE and Java SE Embedded.
- CVE-2017-10111Critical
Vulnerability in the Java SE and Java SE Embedded components of Oracle Java SE, affecting version 8u131. Easily exploitable by an unauthenticated attacker with network access, potentially leading to takeover of Java SE and Java SE Embedded.
- CVE-2017-10107Critical
Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE, affecting the RMI subcomponent. It allows easy exploitation by an unauthenticated attacker with network access, potentially leading to takeover of Java SE and Java SE Embedded.
- CVE-2017-10102Critical
Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE, concerning RMI, allows an unauthenticated attacker with network access to compromise these systems. The attacker can exploit this vulnerability by supplying data to APIs in the specified component.
- CVE-2017-10101Critical
Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) allows an unauthenticated attacker with network access to compromise these systems. It requires human interaction, making attacks potentially impactful on additional products.
- CVE-2017-10096Critical
Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) allows an unauthenticated attacker with network access to compromise these systems. Successful attacks require human interaction, making them easy to execute under the right conditions.
- CVE-2017-10090Critical
A vulnerability in the Java SE and Java SE Embedded components allows easy exploitation by an unauthenticated attacker with network access. It requires human interaction, which may lead to the takeover of Java SE and Java SE Embedded.
Original NVD description (English source)
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: Applies to the Java SE Kerberos client. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).