Red Hat update for java-1.7.1-ibm

1) Information disclosure

EUVDB-ID: #VU8861

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-10165

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to a flaw in the 2D (Little CMS 2) component. A remote attacker can read arbitrary files on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Denial of service

EUVDB-ID: #VU8863

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10281

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Privilege escalation

EUVDB-ID: #VU8865

Risk: Low

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10285

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to a flaw in the RMI component. A remote attacker can escalate his privileges on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU8867

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10295

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to access potentially sensitive information.

The weakness exists due to a flaw in the Javadoc component. A remote attacker can partially modify arbitrary files on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper access control

EUVDB-ID: #VU8871

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10345

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Privilege escalation

EUVDB-ID: #VU8872

Risk: Low

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10346

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to a flaw in the Hotspot component. A remote attacker can escalate his privileges on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Denial of service

EUVDB-ID: #VU8864

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10347

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper access control

EUVDB-ID: #VU8873

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10348

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Libraries component. A remote attacker can trigger partial denial of service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper access control

EUVDB-ID: #VU8874

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10349

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the JAXP component. A remote attacker can trigger partial denial of service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper access control

EUVDB-ID: #VU8875

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10350

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the JAX-WS component. A remote attacker can trigger partial denial of service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper access control

EUVDB-ID: #VU8876

Risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2017-10355

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Networking component. A remote attacker can trigger partial denial of service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

12) Improper access control

EUVDB-ID: #VU9120

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10356

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The weakness exists due to a flaw in the Security component. A remote attacker can gain unauthorized access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper access control

EUVDB-ID: #VU8878

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10357

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Privilege escalation

EUVDB-ID: #VU8881

Risk: Low

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10388

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to a flaw in the Libraries component. A remote attacker can escalate his privileges on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 6 - 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2017:3268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Low
Patch available	YES
Number of vulnerabilities	14
CVE-ID	CVE-2016-10165 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388
CWE-ID	CWE-200 CWE-264
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #11 is available.
Vulnerable software	Red Hat Enterprise Linux for Scientific Computing Operating systems & Components / Operating system Red Hat Enterprise Linux for IBM z Systems Operating systems & Components / Operating system Red Hat Enterprise Linux Desktop Operating systems & Components / Operating system Red Hat Enterprise Linux Workstation Operating systems & Components / Operating system Red Hat Enterprise Linux Server Operating systems & Components / Operating system
Vendor	Red Hat Inc.