CVE-2017-10125

high

Published 2017-08-08 · Modified 2026-05-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

7.1

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.1

Description

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 7u141 and 8u131. Difficult to exploit vulnerability allows physical access to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to deployment of Java where the Java Auto Update is enabled. CVSS 3.0 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Predictions

Exploit likelihood

70%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact

OS	Version	Status	Fixed in
sles		affected
debian	sid	fixed	`0`

Application impact

Vendor	Product	Versions
oracle	jdk	`1.7.0`
oracle	jdk	`1.8.0`
oracle	jre	`1.7.0`
oracle	jre	`1.8.0`
netapp	active_iq_unified_manager	`{"startIncluding":"7.3"}`
netapp	cloud_backup	`-`
netapp	e-series_santricity_os_controller	`{"startIncluding":"11.0","endIncluding":"11.70.1"}`
netapp	e-series_santricity_storage_manager	`-`
netapp	element_software	`-`
netapp	oncommand_balance	`-`
netapp	oncommand_insight	`-`
netapp	oncommand_performance_manager	`-`
netapp	oncommand_shift	`-`
netapp	oncommand_unified_manager	`{"endIncluding":"7.1"}`
netapp	oncommand_unified_manager	`-`
netapp	plug-in_for_symantec_netbackup	`-`
netapp	snapmanager	`-`
netapp	steelstore_cloud_integrated_storage	`-`
netapp	storage_replication_adapter_for_clustered_data_ontap	`{"startIncluding":"7.2"}`
netapp	storage_replication_adapter_for_clustered_data_ontap	`9.6`
netapp	vasa_provider_for_clustered_data_ontap	`{"startIncluding":"7.2"}`
netapp	vasa_provider_for_clustered_data_ontap	`6.0`
netapp	virtual_storage_console	`{"startIncluding":"7.2"}`
netapp	virtual_storage_console	`6.0`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.