What’s Vulnerable › Vulnerabilities

CVE-2017-10388

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-10-19 · updated 2026-06-17

Description

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: Applies to the Java SE Kerberos client. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

Affected products

• Debian Linux: 7.0, 8.0, 9.0
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
• NetApp Cloud Backup: all versions
• NetApp E-Series Santricity Management Plug-Ins: all versions
• E-Series SANtricity OS Controller Software 11.x: from 11.0 through 11.70.1
• NetApp E-Series Santricity Storage Manager: all versions
• NetApp E-Series Santricity Web Services: all versions
• NetApp Element Software: all versions
• NetApp Oncommand Balance: all versions
• OnCommand Insight: all versions
• NetApp Oncommand Performance Manager: all versions
• NetApp Oncommand Shift: all versions
• NetApp OnCommand Unified Manager for 7-Mode (core package): through 7.1
• NetApp OnCommand Workflow Automation: all versions
• NetApp Plug-In For Symantec Netbackup: all versions
• SnapManager for Oracle: all versions
• NetApp Steelstore Cloud Integrated Storage: all versions
• NetApp Storage Replication Adapter For Clustered Data Ontap: from 7.2
• NetApp Vasa Provider For Clustered Data Ontap: from 7.2; 6.0
• NetApp Virtual Storage Console: from 7.2; 6.0
• Oracle Java SE: 1.6.0-update161, 1.7.0-update151, 1.8.0-update144, 1.9.0
• Oracle Java SE: 1.6.0-update161, 1.7.0-update151, 1.8.0-update144, 1.9.0
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Eus: 7.4, 7.5, 7.6, 7.7
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 7.4, 7.6, 7.7
• RedHat Enterprise Linux Server Tus: 7.4, 7.6, 7.7
• RedHat Enterprise Linux Workstation: 6.0, 7.0
• Red Hat Satellite 6: 5.8

References

• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.securityfocus.com/bid/101321
• http://www.securitytracker.com/id/1039596
• https://access.redhat.com/errata/RHSA-2017:2998
• https://access.redhat.com/errata/RHSA-2017:2999
• https://access.redhat.com/errata/RHSA-2017:3046
• https://access.redhat.com/errata/RHSA-2017:3047
• https://access.redhat.com/errata/RHSA-2017:3264
• https://access.redhat.com/errata/RHSA-2017:3267
• https://access.redhat.com/errata/RHSA-2017:3268
• https://access.redhat.com/errata/RHSA-2017:3392
• https://access.redhat.com/errata/RHSA-2017:3453

Get alerted when CVE-2017-10388 or the next vulnerability affects your stack