CVE-2017-10118
published 2017-08-08CVE-2017-10118: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
2.97%
85.7th percentile
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | openjdk-8 | < openjdk-8 8u141-b15-1 (sid) | openjdk-8 8u141-b15-1 (sid) |
| netapp | active_iq_unified_manager | >= 7.3 | — |
| netapp | active_iq_unified_manager | >= 9.5 | — |
| netapp | e-series_santricity_os_controller | 11.0 – 11.70.1 | — |
| netapp | oncommand_unified_manager | <= 7.1 | — |
| netapp | storage_replication_adapter_for_clustered_data_ontap | — | — |
| netapp | storage_replication_adapter_for_clustered_data_ontap | >= 7.2 | — |
| netapp | vasa_provider_for_clustered_data_ontap | — | — |
| netapp | vasa_provider_for_clustered_data_ontap | >= 7.2 | — |
| netapp | virtual_storage_console | — | — |
| netapp | virtual_storage_console | >= 7.2 | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jrockit | — | — |
| oracle_corporation | java | — | — |
| oracle_corporation | java | — | — |
| phoenixcontact | fl_mguard_dm | <= 1.8.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j542-xhh9-hwfg: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)
ghsa_unreviewed·2022-05-13
CVE-2017-10118 [HIGH] GHSA-j542-xhh9-hwfg: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandbox
OSV
openjdk-7 vulnerabilities
osv·2017-08-18·CVSS 5.3
CVE-2017-10053 [MEDIUM] openjdk-7 vulnerabilities
openjdk-7 vulnerabilities
It was discovered that the JPEGImageReader class in OpenJDK would
incorrectly read unused image data. An attacker could use this to specially
construct a jpeg image file that when opened by a Java application would
cause a denial of service. (CVE-2017-10053)
It was discovered that the JAR verifier in OpenJDK did not properly handle
archives containing files missing digests. An attacker could use this to
modify the signed contents of a JAR file. (CVE-2017-10067)
It was discovered that integer overflows existed in the Hotspot component
of OpenJDK when generating range check loop predicates. An attacker could
use this to specially construct an untrusted Java application or applet
that could escape sandbox restrictions and cause a denial of service or
possibly exec
OSV
openjdk-8 regression
osv·2017-07-31·CVSS 5.3
[MEDIUM] openjdk-8 regression
openjdk-8 regression
USN-3366-1 fixed vulnerabilities in OpenJDK 8. Unfortunately, that
update introduced a regression that caused some valid JAR files to
fail validation. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the JPEGImageReader class in OpenJDK would
incorrectly read unused image data. An attacker could use this to
specially construct a jpeg image file that when opened by a Java
application would cause a denial of service. (CVE-2017-10053)
It was discovered that the JAR verifier in OpenJDK did not properly
handle archives containing files missing digests. An attacker could
use this to modify the signed contents of a JAR file. (CVE-2017-10067)
It was discovered that integer overflows existed in the Hotspo
OSV
openjdk-8 vulnerabilities
osv·2017-07-26·CVSS 5.3
CVE-2017-10053 [MEDIUM] openjdk-8 vulnerabilities
openjdk-8 vulnerabilities
It was discovered that the JPEGImageReader class in OpenJDK would
incorrectly read unused image data. An attacker could use this to
specially construct a jpeg image file that when opened by a Java
application would cause a denial of service. (CVE-2017-10053)
It was discovered that the JAR verifier in OpenJDK did not properly
handle archives containing files missing digests. An attacker could
use this to modify the signed contents of a JAR file. (CVE-2017-10067)
It was discovered that integer overflows existed in the Hotspot
component of OpenJDK when generating range check loop predicates. An
attacker could use this to specially construct an untrusted Java
application or applet that could escape sandbox restrictions
and cause a denial of service or possibly exec
OSV
CVE-2017-10118: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)
osv·2017-07-20·CVSS 7.5
CVE-2017-10118 [HIGH] CVE-2017-10118: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandbox
CISA ICS
PHOENIX CONTACT mGuard Device Manager
cisa_ics·2017-09-19
PHOENIX CONTACT mGuard Device Manager
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
PHOENIX CONTACT mGuard Device Manager
Last RevisedSeptember 19, 2017
Alert CodeICSA-17-262-01
## CVSS v3 9.0
ATTENTION: Remotely exploitable/low skill level to exploit.
Vendor: PHOENIX CONTACT
Equipment: mGuard Device Manager
Vulnerabilities: Improper Access Control vulnerabilities for Oracle Java SE
## AFFECTED PRODUCTS
The following versions of mGuard Device Manager, a device management software for mGuard devices, are affected:
- mGuard Device Manager 1.8.0 and older.
## IMPACT
Successful exploitation of these vulnerabilities could allow unauthorized remote access, mo
Ubuntu
OpenJDK 7 vulnerabilities
vendor_ubuntu·2017-08-18·CVSS 5.3
CVE-2017-10053 [MEDIUM] OpenJDK 7 vulnerabilities
Title: OpenJDK 7 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 7.
It was discovered that the JPEGImageReader class in OpenJDK would
incorrectly read unused image data. An attacker could use this to specially
construct a jpeg image file that when opened by a Java application would
cause a denial of service. (CVE-2017-10053)
It was discovered that the JAR verifier in OpenJDK did not properly handle
archives containing files missing digests. An attacker could use this to
modify the signed contents of a JAR file. (CVE-2017-10067)
It was discovered that integer overflows existed in the Hotspot component
of OpenJDK when generating range check loop predicates. An attacker could
use this to specially construct an untrusted Java application or applet
that could escape s
Ubuntu
OpenJDK 8 regression
vendor_ubuntu·2017-07-31·CVSS 5.3
[MEDIUM] OpenJDK 8 regression
Title: OpenJDK 8 regression
Summary: USN 3366-1 introduced a regression in OpenJDK 8.
USN-3366-1 fixed vulnerabilities in OpenJDK 8. Unfortunately, that
update introduced a regression that caused some valid JAR files to
fail validation. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the JPEGImageReader class in OpenJDK would
incorrectly read unused image data. An attacker could use this to
specially construct a jpeg image file that when opened by a Java
application would cause a denial of service. (CVE-2017-10053)
It was discovered that the JAR verifier in OpenJDK did not properly
handle archives containing files missing digests. An attacker could
use this to modify the signed contents of a JAR file. (CVE-2017-1006
Ubuntu
OpenJDK 8 vulnerabilities
vendor_ubuntu·2017-07-26·CVSS 5.3
CVE-2017-10053 [MEDIUM] OpenJDK 8 vulnerabilities
Title: OpenJDK 8 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 8.
It was discovered that the JPEGImageReader class in OpenJDK would
incorrectly read unused image data. An attacker could use this to
specially construct a jpeg image file that when opened by a Java
application would cause a denial of service. (CVE-2017-10053)
It was discovered that the JAR verifier in OpenJDK did not properly
handle archives containing files missing digests. An attacker could
use this to modify the signed contents of a JAR file. (CVE-2017-10067)
It was discovered that integer overflows existed in the Hotspot
component of OpenJDK when generating range check loop predicates. An
attacker could use this to specially construct an untrusted Java
application or applet that could escape s
Red Hat
OpenJDK: ECDSA implementation timing attack (JCE, 8175110)
vendor_redhat·2017-07-18·CVSS 7.5
CVE-2017-10118 [HIGH] CWE-385 OpenJDK: ECDSA implementation timing attack (JCE, 8175110)
OpenJDK: ECDSA implementation timing attack (JCE, 8175110)
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component wi
Debian
CVE-2017-10118: openjdk-8 - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java...
vendor_debian·2017·CVSS 7.5
CVE-2017-10118 [HIGH] CVE-2017-10118: openjdk-8 - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java...
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandbox
No detection rules found.
Bugzilla
P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function
bugzilla·2020-03-17
P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function
P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function
Mail to security@ from Alejandro Cabrera Aldaya:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
We recently dig into how the EC projective coordinates attack proposed in [1] could affect NSS.
The attack in [1] aims at recover some bits of the scalar starting from the projective representation
of an scalar multiplication output point.
Schemes like ECDSA are very sensitive to scalar leaks, therefore the attack in [1] can thwarts the security of an implementation if the attacker knows the projective representation of the product kG in ECDSA.
The success rate of the attack proposed in [1] depends on several factors such as:
* Elliptic curve form (Weierstrass, Montogmery, etc.)
* The
Bugzilla
side-channel leakage in ECDSA signature generation
bugzilla·2019-07-22
[MEDIUM] side-channel leakage in ECDSA signature generation
side-channel leakage in ECDSA signature generation
Our security alias received the following from Ján Jančár:
I am a security researcher at Masaryk University in Brno, Czech Republic.
During our research into security of elliptic curve cryptography implementations
on smart-cards and in software libraries [1], we have discovered side-channel
leakage (cache) in the ECDSA signature generation in the Mozilla nss library.
The side-channel is present in the scalar multiplication algorithm in
(lib/freebl/ecl/ecp_jm.c) ec_GFp_pt_mul_jm_wNAF. A local attacker that is able
to observe the order of double and add calls in the loop on lines 265-275 during
ECDSA signing, either through a cache side channel [2,3] or port contention [4]
or a similar microarchitectural side-channel, will be able to rec
Bugzilla
8175110, CVE-2017-10118: Higher quality ECDSA operations
bugzilla·2017-08-03·CVSS 7.5
CVE-2017-10118 [HIGH] 8175110, CVE-2017-10118: Higher quality ECDSA operations
8175110, CVE-2017-10118: Higher quality ECDSA operations
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0
Build ID: 20170705063546
Steps to reproduce:
OpenJDK and NSS share a common source for elliptic curve cryptography code in the form of the SunEC library.
The following security fix for the OpenJDK copy of the code was released on the 18th of July, 2017:
http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/996632997de8
and should also be considered for NSS. It adds a timing mitigation to ec_GFp_pt_mul_jm_wNAF.
Discussion:
CVE-2017-10118 is still "reserved". Do you know who obtained it? is there a link to an advisory for this change?
A fix for the NSS implementation would need a separate CVE because it's a different codebase/language, despite common anc
Bugzilla
CVE-2017-10118 OpenJDK: ECDSA implementation timing attack (JCE, 8175110)
bugzilla·2017-07-18·CVSS 7.5
CVE-2017-10118 [HIGH] CVE-2017-10118 OpenJDK: ECDSA implementation timing attack (JCE, 8175110)
CVE-2017-10118 OpenJDK: ECDSA implementation timing attack (JCE, 8175110)
A covert timing channel flaw was found in the ECDSA implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application generate ECDSA signatures on demand could possibly use this flaw to extract certain information about the used key via a timing side channel.
Discussion:
Public now via Oracle CPU July 2017:
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixJAVA
The issue was fixed in Oracle JDK 8u141 and 7u151.
---
OpenJDK-8 upstream commit:
http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/996632997de8
---
This issue has been addressed in the following products:
Oracle Java for Red Hat Enterprise Linux 7
Oracle Java for Red Hat Enterprise Linu
http://www.debian.org/security/2017/dsa-3919http://www.debian.org/security/2017/dsa-3954http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.securityfocus.com/bid/99782http://www.securitytracker.com/id/1038931https://access.redhat.com/errata/RHSA-2017:1790https://access.redhat.com/errata/RHSA-2017:1791https://cert.vde.com/en-us/advisories/vde-2017-002https://security.gentoo.org/glsa/201709-22https://security.netapp.com/advisory/ntap-20170720-0001/http://www.debian.org/security/2017/dsa-3919http://www.debian.org/security/2017/dsa-3954http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.securityfocus.com/bid/99782http://www.securitytracker.com/id/1038931https://access.redhat.com/errata/RHSA-2017:1790https://access.redhat.com/errata/RHSA-2017:1791https://cert.vde.com/en-us/advisories/vde-2017-002https://security.gentoo.org/glsa/201709-22https://security.netapp.com/advisory/ntap-20170720-0001/
2017-08-08
Published