CVE-2017-10074 is a critical vulnerability in Oracle Java SE and Java SE Embedded (Hotspot subcomponent), affecting versions 6u151, 7u141, and 8u131. This vulnerability allows an unauthenticated attacker to compromise affected Java deployments, particularly client-side applications running untrusted code in a sandbox. The attack requires user interaction and, despite its difficulty, can lead to complete system takeover with high impacts on confidentiality, integrity, and availability, as reflected by its CVSS 3.0 Base Score of 8.3. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), nor is there evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.6.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.6.0:update151:*:*:*:*:*:* | ||
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.7.0:update141:*:*:*:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update131:*:*:*:*:*:* | ||
1.6.0CPE matchmatch criteria | cpe:2.3:a:oracle:jre:1.6.0:update151:*:*:*:*:*:* | ||
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jre:1.7.0:update141:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.4 Bluesky, 0.2 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.6 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.