CVE-2017-10102

Public on 2017-07-25
Modified on 2017-08-15
Description
It was discovered that the DCG implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application.
Severity
Critical
CVSS v3 Base Score
8.1
See breakdown

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 1 java-1.8.0-openjdk 2017-07-25 17:54 ALAS-2017-860
Amazon Linux 1 java-1.7.0-openjdk 2017-08-15 17:30 ALAS-2017-869

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
NVD CVSSv3 9.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H