CVE-2017-3544
UnknownEPSS 1.67%
Last modified
CVE-2017-3544 is a vulnerability of currently unknown severity. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. EPSS estimates a 1.67% chance of exploitation in the next 30 days.
Description
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Metrics
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Oracle | Jdk | 1.6.0 | Update141 |
| Oracle | Jdk | 1.7.0 | Update131 |
| Oracle | Jdk | 1.8.0 | Update121 |
| Oracle | Jre | 1.6.0 | Update141 |
| Oracle | Jre | 1.7.0 | Update 131 |
| Oracle | Jre | 1.8.0 | Update 121 |
| Oracle | Jrockit | r28.3.13 | — |
| Redhat | Satellite | 5.8 | — |
| Debian | Debian Linux | 8.0 | — |
| Redhat | Enterprise Linux Desktop | 6.0 | — |
| Redhat | Enterprise Linux Desktop | 7.0 | — |
| Redhat | Enterprise Linux Server | 6.0 | — |
| Redhat | Enterprise Linux Server | 7.0 | — |
| Redhat | Enterprise Linux Server Aus | 7.3 | — |
| Redhat | Enterprise Linux Server Aus | 7.4 | — |
| Redhat | Enterprise Linux Server Aus | 7.6 | — |
| Redhat | Enterprise Linux Server Eus | 7.3 | — |
| Redhat | Enterprise Linux Server Eus | 7.4 | — |
| Redhat | Enterprise Linux Server Eus | 7.5 | — |
| Redhat | Enterprise Linux Server Eus | 7.6 | — |
| Redhat | Enterprise Linux Server Tus | 7.3 | — |
| Redhat | Enterprise Linux Server Tus | 7.6 | — |
| Redhat | Enterprise Linux Workstation | 6.0 | — |
| Redhat | Enterprise Linux Workstation | 7.0 | — |
| Redhat | Icedtea | < 3.4.0 | — |
| Android | 4.4.4 | — | |
| Android | 5.0.2 | — | |
| Android | 5.1.1 | — | |
| Android | 6.0 | — | |
| Android | 6.0.1 | — | |
| Android | 7.0 | — | |
| Android | 7.1.1 | — | |
| Android | 7.1.2 | — |
References
- http://www.debian.org/security/2017/dsa-3858Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/97745Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038286Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1108Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1109Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1117Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1118Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1119Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1204Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1220Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1221Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1222Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3453Third Party Advisory
- https://security.gentoo.org/glsa/201705-03Third Party Advisory
- https://security.gentoo.org/glsa/201707-01Third Party Advisory
- https://source.android.com/security/bulletin/2017-07-01Patch, Third Party Advisory
- http://www.debian.org/security/2017/dsa-3858Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/97745Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038286Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1108Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1109Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1117Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1118Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1119Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1204Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1220Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1221Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1222Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3453Third Party Advisory
- https://security.gentoo.org/glsa/201705-03Third Party Advisory
- https://security.gentoo.org/glsa/201707-01Third Party Advisory
- https://source.android.com/security/bulletin/2017-07-01Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-3544?
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
How severe is CVE-2017-3544?
Severity scoring for CVE-2017-3544 is pending analysis. The EPSS model estimates a 1.67% probability of exploitation in the next 30 days.
How do I fix CVE-2017-3544?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-3538Vulnerability in the Oracle VM VirtualBox component of Oracl…
- CVE-2017-3539Vulnerability in the Java SE, Java SE Embedded component of …
- CVE-2017-3540Vulnerability in the Oracle WebCenter Sites component of Ora…
- CVE-2017-3541Vulnerability in the Oracle WebCenter Sites component of Ora…
- CVE-2017-3542Vulnerability in the Oracle WebCenter Sites component of Ora…
- CVE-2017-3543Vulnerability in the Oracle WebCenter Sites component of Ora…
- CVE-2017-3545Vulnerability in the Oracle WebCenter Sites component of Ora…
- CVE-2017-3546Vulnerability in the PeopleSoft Enterprise PeopleTools compo…
- CVE-2017-3547Vulnerability in the PeopleSoft Enterprise PeopleTools compo…
- CVE-2017-3548Vulnerability in the PeopleSoft Enterprise PeopleTools compo…
- CVE-2017-3549Vulnerability in the Oracle Scripting component of Oracle E-…
- CVE-2017-3550Vulnerability in the Oracle Customer Interaction History com…
Are you affected by CVE-2017-3544?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST