CVE-2017-1376
critical
CVSS v3
9.8
CVSS v2
7.5
VIR risk
9.8
Description
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2017-1376.html
Vendor advisory: psirt@us.ibm.com — https://exchange.xforce.ibmcloud.com/vulnerabilities/126873
Vendor advisory: psirt@us.ibm.com — http://www.ibm.com/support/docview.wss?uid=swg22007305&myns=swgtiv&mynp=OCSSJQQ3&mync=E&cm_sp=swgtiv-_-OCSSJQQ3-_-E
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ibm | operations_analytics_predictive_insights | 1.3.0 | |
| ibm | operations_analytics_predictive_insights | 1.3.1 | |
| ibm | operations_analytics_predictive_insights | 1.3.2 | |
| ibm | operations_analytics_predictive_insights | 1.3.3 | |
| ibm | operations_analytics_predictive_insights | 1.3.5 | |
| ibm | operations_analytics_predictive_insights | 1.3.6 | |
References
- http://www.ibm.com/support/docview.wss?uid=swg22007305&myns=swgtiv&mynp=OCSSJQQ3&mync=E&cm_sp=swgtiv-_-OCSSJQQ3-_-E
- https://access.redhat.com/errata/RHSA-2017:2469
- https://access.redhat.com/errata/RHSA-2017:2481
- https://exchange.xforce.ibmcloud.com/vulnerabilities/126873
- https://www.suse.com/security/cve/CVE-2017-1376.html
CWEs
CWE-829
Verify integrity in audit chain (admin only). AS-IS.