| Description: | Vulnerability in the Java SE, Java SE Embedded, JRockit component of
Oracle Java SE (subcomponent: JNDI). Supported versions that are
affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded:
8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows
unauthenticated attacker with network access via multiple protocols to
compromise Java SE, Java SE Embedded, JRockit. Successful attacks
require human interaction from a person other than the attacker and
while the vulnerability is in Java SE, Java SE Embedded, JRockit,
attacks may significantly impact additional products. Successful
attacks of this vulnerability can result in takeover of Java SE, Java
SE Embedded, JRockit. Note: This vulnerability applies to client and
server deployment of Java. This vulnerability can be exploited through
sandboxed Java Web Start applications and sandboxed Java applets. It
can also be exploited by supplying data to APIs in the specified
Component without using sandboxed Java Web Start applications or
sandboxed Java applets, such as through a web service. CVSS 3.0 Base
Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS
Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
|
