CVE-2017-3539

15

FAUCET Score

CVE-2017-3539 is a low-severity vulnerability in Oracle Java SE (versions 6u141, 7u131, 8u121) and Java SE Embedded (version 8u121), specifically affecting the Security subcomponent. It allows an unauthenticated attacker to achieve unauthorized data modification (update, insert, or delete) on accessible data within sandboxed Java Web Start applications or applets. Exploitation is difficult, requires human interaction, and has a CVSS 3.0 base score of 3.1. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in the CISA KEV catalog.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		1.6.0CPE matchmatch criteria	cpe:2.3:a:oracle:jdk:1.6.0:update141::::::
		1.7.0CPE matchmatch criteria	cpe:2.3:a:oracle:jdk:1.7.0:update131::::::
		1.8.0CPE matchmatch criteria	cpe:2.3:a:oracle:jdk:1.8.0:update121::::::
		1.6.0CPE matchmatch criteria	cpe:2.3:a:oracle:jre:1.6.0:update141::::::
		1.7.0CPE matchmatch criteria	cpe:2.3:a:oracle:jre:1.7.0:update_131::::::

CVSS Data

CVSS version used by this source: 3.0

3.1LOW

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Exploitability Score

1.6

Impact Score

1.4

CvssVersion

3.0

Exploit Intelligence

EPSS Score

1.99%

Probability of exploitation in next 30 days

EPSS Percentile

78.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0199 is in the 84th percentile among its peer group of 232 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (23)

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.8.0-oracle-1:1.8.0.131-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.7.0-oracle-1:1.7.0.141-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.6.0-sun-1:1.6.0.151-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.8.0-oracle-1:1.8.0.131-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.7.0-oracle-1:1.7.0.141-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.6.0-sun-1:1.6.0.151-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: java-1.8.0-openjdk-1:1.8.0.131-0.b11.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: java-1.7.0-openjdk-1:1.7.0.141-2.6.10.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.8.0-ibm-1:1.8.0.4.5-1jpp.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.7.1-ibm-1:1.7.1.4.5-1jpp.2.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.6.0-ibm-1:1.6.0.16.45-1jpp.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: java-1.8.0-openjdk-1:1.8.0.131-2.b11.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: java-1.7.0-openjdk-1:1.7.0.141-2.6.10.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 SupplementaryFixed in: java-1.8.0-ibm-1:1.8.0.4.5-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 SupplementaryFixed in: java-1.7.1-ibm-1:1.7.1.4.5-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 5.8Fixed in: java-1.8.0-ibm-1:1.8.0.5.5-1jpp.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 5.8 ELSFixed in: java-1.8.0-ibm-1:1.8.0.5.5-1jpp.1.el6_9

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.6.0-sun

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.7.0-openjdk

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.7.0-oracle

redhatend of lifevia redhat_api

Product: Red Hat Satellite 5Fixed in: java-1.6.0-ibm

redhatend of lifevia redhat_api

Product: Red Hat Satellite 5Fixed in: java-1.7.1-ibm

Vendor Advisories (1)

redhatCVE-2017-3539Moderate

OpenJDK: MD5 allowed for jar verification (Security, 8171121)

References

access.redhat.com / errata/RHSA-2017:1108

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1109

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1117

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1118

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1119

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1204

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1220

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1221

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1222

Third Party Advisory

access.redhat.com / errata/RHSA-2017:3453

Third Party Advisory

security.gentoo.org / glsa/201705-03

Third Party Advisory

security.gentoo.org / glsa/201707-01

Third Party Advisory

debian.org / security/2017/dsa-3858

Third Party Advisory

oracle.com / technetwork/security-advisory/cpuapr2017-3236618.html

PatchVendor Advisory

securityfocus.com / bid/97752

Third Party AdvisoryVDB Entry

securitytracker.com / id/1038286

Third Party AdvisoryVDB Entry