CVE-2017-10285

critical

Published 2017-10-19 · Modified 2026-05-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

9.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

9.6

Description

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

Predictions

Exploit likelihood

96%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact

OS	Version	Status	Fixed in
sles		affected
debian	sid	fixed	`8u151-b12-1`
debian	7.0	affected
debian	8.0	affected
debian	9.0	affected
rhel	6.0	affected
rhel	7.0	affected
rhel	7.4	affected
rhel	7.5	affected
rhel	7.6	affected
rhel	7.7	affected

Application impact

Vendor	Product	Versions
oracle	jdk	`1.6.0`
oracle	jdk	`1.7.0`
oracle	jdk	`1.8.0`
oracle	jdk	`1.9.0`
oracle	jre	`1.6.0`
oracle	jre	`1.7.0`
oracle	jre	`1.8.0`
oracle	jre	`1.9.0`
redhat	satellite	`5.8`
netapp	active_iq_unified_manager	`{"startIncluding":"7.3"}`
netapp	cloud_backup	`-`
netapp	e-series_santricity_management_plug-ins	`-`
netapp	e-series_santricity_os_controller	`{"startIncluding":"11.0","endIncluding":"11.70.1"}`
netapp	e-series_santricity_storage_manager	`-`
netapp	e-series_santricity_web_services	`-`
netapp	element_software	`-`
netapp	oncommand_balance	`-`
netapp	oncommand_insight	`-`
netapp	oncommand_performance_manager	`-`
netapp	oncommand_shift	`-`
netapp	oncommand_unified_manager	`{"endIncluding":"7.1"}`
netapp	oncommand_unified_manager	`-`
netapp	oncommand_workflow_automation	`-`
netapp	plug-in_for_symantec_netbackup	`-`
netapp	snapmanager	`-`
netapp	steelstore_cloud_integrated_storage	`-`
netapp	storage_replication_adapter_for_clustered_data_ontap	`{"startIncluding":"7.2"}`
netapp	vasa_provider_for_clustered_data_ontap	`{"startIncluding":"7.2"}`
netapp	vasa_provider_for_clustered_data_ontap	`6.0.`
netapp	virtual_storage_console	`{"startIncluding":"7.2"}`
netapp	virtual_storage_console	`6.0`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.