Name: CVE-2017-1376: Inclusion of Functionality from Untrusted Control Sphere
Creator: Rapid7
Published: 2017-08-29T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2017-1376, CWE-829, CVSS 9.8, EPSS 0.02634

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.

CVSS Details

CVSS 3.0 Base Score: 9.8
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Centos_linux	—	Upgrade java-1.8.0-ibm-demoUpgrade java-1.8.0-ibm-srcUpgrade java-1.8.0-ibmUpgrade java-1.7.1-ibm-demoUpgrade java-1.8.0-ibm-pluginUpgrade java-1.7.1-ibm-pluginUpgrade java-1.7.1-ibmUpgrade java-1.8.0-ibm-jdbcUpgrade java-1.7.1-ibm-develUpgrade java-1.7.1-ibm-jdbcUpgrade java-1.8.0-ibm-develUpgrade java-1.7.1-ibm-src	Aug 28, 2019	Aug 29, 2017
Ibm Aix	—	Apply the fix or workaround for java_july2017_advisory	Nov 6, 2017	Aug 28, 2017
Ibm Java	—	Upgrade IBM Java to version 6.1.8.50Upgrade IBM Java to version 8.0.4.7Upgrade IBM Java to version 7.1.4.10Upgrade IBM Java to version 7.0.10.10	Oct 20, 2026	Oct 20, 2026
Redhat_linux	—	Upgrade java-1.7.1-ibmUpgrade java-1.7.1-ibm-pluginUpgrade java-1.8.0-ibm-pluginUpgrade java-1.7.1-ibm-demoUpgrade java-1.7.1-ibm-jdbcUpgrade java-1.7.1-ibm-srcUpgrade java-1.8.0-ibm-demoUpgrade java-1.8.0-ibmUpgrade java-1.8.0-ibm-develUpgrade java-1.8.0-ibm-srcUpgrade java-1.8.0-ibm-jdbcUpgrade java-1.7.1-ibm-devel	Aug 22, 2017	Aug 14, 2017
Ubuntu	—	Upgrade ibm-java80	Nov 19, 2024	Aug 29, 2017

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business