Search for vulnerabilities
Vulnerability details: VCID-3an1-22s2-aaae
Vulnerability ID VCID-3an1-22s2-aaae
Aliases CVE-2017-3526
Summary Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Status Published
Exploitability 0.5
Weighted Severity 6.4
Risk 3.2
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-770 Allocation of Resources Without Limits or Throttling
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-3526.html
rhas Moderate https://access.redhat.com/errata/RHSA-2017:1108
ssvc Track https://access.redhat.com/errata/RHSA-2017:1108
rhas Moderate https://access.redhat.com/errata/RHSA-2017:1109
ssvc Track https://access.redhat.com/errata/RHSA-2017:1109
rhas Moderate https://access.redhat.com/errata/RHSA-2017:1117
ssvc Track https://access.redhat.com/errata/RHSA-2017:1117
rhas Moderate https://access.redhat.com/errata/RHSA-2017:1118
ssvc Track https://access.redhat.com/errata/RHSA-2017:1118
rhas Moderate https://access.redhat.com/errata/RHSA-2017:1119
ssvc Track https://access.redhat.com/errata/RHSA-2017:1119
rhas Moderate https://access.redhat.com/errata/RHSA-2017:1204
ssvc Track https://access.redhat.com/errata/RHSA-2017:1204
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-3526.json
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00495 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00495 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00495 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00495 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00495 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00495 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00495 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00495 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00495 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00556 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00556 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.00556 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.01924 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.02692 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
epss 0.04925 https://api.first.org/data/v1/epss?cve=CVE-2017-3526
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1443252
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3509
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3511
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3526
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3533
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3539
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3544
cvssv2 2.6 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 7.1 https://nvd.nist.gov/vuln/detail/CVE-2017-3526
cvssv3 5.9 https://nvd.nist.gov/vuln/detail/CVE-2017-3526
generic_textual Low https://ubuntu.com/security/notices/USN-3275-1
generic_textual Low https://ubuntu.com/security/notices/USN-3275-2
cvssv3.1 3.3 http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
generic_textual LOW http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-3526.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-3526.json
https://api.first.org/data/v1/epss?cve=CVE-2017-3526
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3509
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3511
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3526
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3533
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3539
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3544
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://security.gentoo.org/glsa/201705-03
https://security.gentoo.org/glsa/201707-01
https://ubuntu.com/security/notices/USN-3275-1
https://ubuntu.com/security/notices/USN-3275-2
http://www.debian.org/security/2017/dsa-3858
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
http://www.securityfocus.com/bid/97733
http://www.securitytracker.com/id/1038286
1443252 https://bugzilla.redhat.com/show_bug.cgi?id=1443252
cpe:2.3:a:oracle:jdk:1.6:update_141:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:1.6:update_141:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7:update_131:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:1.7:update_131:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8:update_121:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:1.8:update_121:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6:update_141:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:1.6:update_141:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7:update_131:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:1.7:update_131:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.8:update_121:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:1.8:update_121:*:*:*:*:*:*
cpe:2.3:a:oracle:jrockit:r28.3.13:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jrockit:r28.3.13:*:*:*:*:*:*:*
CVE-2017-3526 https://nvd.nist.gov/vuln/detail/CVE-2017-3526
RHSA-2017:1108 https://access.redhat.com/errata/RHSA-2017:1108
RHSA-2017:1109 https://access.redhat.com/errata/RHSA-2017:1109
RHSA-2017:1117 https://access.redhat.com/errata/RHSA-2017:1117
RHSA-2017:1118 https://access.redhat.com/errata/RHSA-2017:1118
RHSA-2017:1119 https://access.redhat.com/errata/RHSA-2017:1119
RHSA-2017:1204 https://access.redhat.com/errata/RHSA-2017:1204
USN-3275-1 https://usn.ubuntu.com/3275-1/
USN-3275-2 https://usn.ubuntu.com/3275-2/
No exploits are available.
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-07T15:45:02Z/ Found at https://access.redhat.com/errata/RHSA-2017:1108
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-07T15:45:02Z/ Found at https://access.redhat.com/errata/RHSA-2017:1109
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-07T15:45:02Z/ Found at https://access.redhat.com/errata/RHSA-2017:1117
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-07T15:45:02Z/ Found at https://access.redhat.com/errata/RHSA-2017:1118
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-07T15:45:02Z/ Found at https://access.redhat.com/errata/RHSA-2017:1119
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-07T15:45:02Z/ Found at https://access.redhat.com/errata/RHSA-2017:1204
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-3526.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2017-3526
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-3526
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.73385
EPSS Score 0.00404
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.