Oracle Java SE and JRockit CVE-2017-10109 Remote Security Vulnerability

Bugtraq ID:	99847
Class:	Unknown
CVE:	CVE-2017-10109
Remote:	Yes
Local:	No
Published:	Jul 18 2017 12:00AM
Updated:	Sep 06 2017 08:13PM
Credit:	Gaston Traberg of Onapsis
Vulnerable:	Ubuntu Ubuntu Linux 17.04 Ubuntu Ubuntu Linux 16.04 LTS Redhat Enterprise Linux Workstation Supplementary 7 Redhat Enterprise Linux Workstation Supplementary 6 Redhat Enterprise Linux Supplementary 7 Client Redhat Enterprise Linux Server Supplementary 7 Redhat Enterprise Linux Server Supplementary 6 Redhat Enterprise Linux HPC Node Supplementary 6 Redhat Enterprise Linux Desktop Supplementary 6 Redhat Enterprise Linux ComputeNode Supplementary 7 Oracle JRockit R28.3.14 Oracle JRE(Windows Production Release) 1.8 Update 131 Oracle JRE(Windows Production Release) 1.7 Update 141 Oracle JRE(Windows Production Release) 1.6 Update 151 Oracle JRE(Solaris Production Release) 1.8 Update 131 Oracle JRE(Solaris Production Release) 1.7 Update 141 Oracle JRE(Solaris Production Release) 1.6 Update 151 Oracle JRE(Linux Production Release) 1.8 Update 131 Oracle JRE(Linux Production Release) 1.7 Update 141 Oracle JRE(Linux Production Release) 1.6 Update 151 Oracle JDK(Windows Production Release) 1.8 Update 131 Oracle JDK(Windows Production Release) 1.7 Update 141 Oracle JDK(Windows Production Release) 1.6 Update 151 Oracle JDK(Solaris Production Release) 1.8 Update 131 Oracle JDK(Solaris Production Release) 1.7 Update 141 Oracle JDK(Solaris Production Release) 1.6 Update 151 Oracle JDK(Linux Production Release) 1.8 Update 131 Oracle JDK(Linux Production Release) 1.7 Update 141 Oracle JDK(Linux Production Release) 1.6 Update 151 IBM Vios 2.2.3 IBM Vios 2.2 IBM Java SDK 8.0.4.5 IBM Java SDK 8.0.4.1 IBM Java SDK 8.0.4.0 IBM Java SDK 7.1.4.5 IBM Java SDK 7.1.4.1 IBM Java SDK 7.1.4.0 IBM Java SDK 7.0.10.5 IBM Java SDK 7.0.10.1 IBM Java SDK 7.0.10.0 IBM Aix 7.2 IBM AIX 7.1 IBM AIX 6.1 IBM AIX 5.3 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	IBM Java SDK 8.0.4.10 IBM Java SDK 7.1.4.10 IBM Java SDK 7.0.10.10

Oracle Java SE and JRockit CVE-2017-10109 Remote Security Vulnerability

Oracle Java SE and JRockit are prone to a remote security vulnerability.

The vulnerability can be exploited over multiple protocols. This issue affects the 'Serialization' component.

This vulnerability affects the following supported versions:
Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14

Oracle Java SE and JRockit CVE-2017-10109 Remote Security Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle Java SE and JRockit CVE-2017-10109 Remote Security Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oracle Java SE and JRockit CVE-2017-10109 Remote Security Vulnerability

References:

• Oracle Homepage (Oracle)
  
• Oracle Critical Patch Update Advisory - July 2017 (Oracle)
  
• Oracle July 18 2017 CPU (1.6.0_161, 1.7.0_151, 1.8.0_141) (IBM)
  
• Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX (IBM)