CVE-2017-10116

high

Published 2017-08-08 · Modified 2026-05-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

8.3

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.3

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Predictions

Exploit likelihood

89%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact

OS	Version	Status	Fixed in
sles		affected
debian	sid	fixed	`8u141-b15-1`
debian	8.0	affected
debian	9.0	affected
rhel	6.0	affected
rhel	7.0	affected
rhel	7.3	affected
rhel	7.4	affected
rhel	7.5	affected
rhel	7.6	affected
rhel	7.7	affected

Application impact

Vendor	Product	Versions
oracle	jdk	`1.6.0`
oracle	jdk	`1.7.0`
oracle	jdk	`1.8.0`
oracle	jre	`1.6.0`
oracle	jre	`1.7.0`
oracle	jre	`1.8.0`
oracle	jrockit	`r28.3.14`
phoenixcontact	fl_mguard_dm	`1.8.0`
redhat	satellite	`5.8`
netapp	active_iq_unified_manager	`{"startIncluding":"7.3"}`
netapp	cloud_backup	`-`
netapp	e-series_santricity_os_controller	`{"startIncluding":"11.0","endIncluding":"11.70.1"}`
netapp	e-series_santricity_storage_manager	`-`
netapp	element_software	`-`
netapp	oncommand_balance	`-`
netapp	oncommand_insight	`-`
netapp	oncommand_performance_manager	`-`
netapp	oncommand_shift	`-`
netapp	oncommand_unified_manager	`{"endIncluding":"7.1"}`
netapp	oncommand_unified_manager	`-`
netapp	plug-in_for_symantec_netbackup	`-`
netapp	snapmanager	`-`
netapp	steelstore_cloud_integrated_storage	`-`
netapp	storage_replication_adapter_for_clustered_data_ontap	`{"startIncluding":"7.2"}`
netapp	storage_replication_adapter_for_clustered_data_ontap	`9.6`
netapp	vasa_provider_for_clustered_data_ontap	`{"startIncluding":"7.2"}`
netapp	vasa_provider_for_clustered_data_ontap	`6.0`
netapp	virtual_storage_console	`{"startIncluding":"7.2"}`
netapp	virtual_storage_console	`6.0`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.