9

CVE-2017-3241: oracle java_se Improper Input Validation

Modified
AliasesUBUNTU-CVE-2017-3241CGA-29jx-rpqm-prq6CGA-2vv3-9pvv-6qww
Published 27-01-2017Last modified 09-10-2024

Vulnerability summary

CVE-2017-3241 is a critical (CVSS 9.0) Improper Input Validation vulnerability in oracle java_se. EPSS estimates a 32.84% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (exploit-database, 23-01-2017)

Source freshness unavailable

How is this decided?
CVSS score
9.0/10
010
Critical · v3.0 (NVD)
EPSS score
32.84%
0%100%
High · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 19 · Related 11
DLA-821-1DSA-3782-1MGASA-2017-0041OPENSUSE-SU-2024:10876-1RHSA-2017:0175RHSA-2017:0176

Timeline

  1. 27-01-2017
    PublishedVulnerability first disclosed.
  2. 09-10-2024
    Last modifiedVulnerability information updated.

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

32.84%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 32.84% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • exploit-databasedosmultipleVerified

    Oracle OpenJDK Runtime Environment 1.8.0_112-b15 - Java Serialization Denial Of Service

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard16 products
  • openjdk-11-openj9-default-policy< 0.53.0-r0
  • openjdk-17-openj9-default-policy< 0.53.0-r0
  • openjdk-21-openj9-default-policy< 0.53.0-r0
  • openjdk-25-openj9< 0.59.0-r1
  • openjdk-25-openj9-dbg< 0.59.0-r1
Oracle5 products
  • java_se6u131 | 7u121 | 8u112
  • java se embedded8u111
  • jdk1.6:update_131 | 1.7:update_121 | 1.8:update_111 | 1.8:update_112
  • jre1.6:update_131 | 1.7:update_121 | 1.8:update_111 | 1.8:update_112
  • jrockitR28.3.12 | r28.3.12
Ubuntu3 products
  • openjdk-6< 6b41-1.13.13-0ubuntu0.14.04.1
  • openjdk-7< 7u121-2.6.8-1ubuntu0.14.04.3
  • openjdk-8< 8u121-b13-0ubuntu1.16.04.2

3 vendors · 24 products

References

28 links
Show all 28 references