Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2017-3511

20
FAUCET Score

CVE-2017-3511 is a critical vulnerability in Oracle Java SE, Java SE Embedded, and JRockit (specifically the JCE subcomponent) affecting versions 7u131, 8u121, and R28.3.13 respectively. This vulnerability, with a CVSS v3.0 score of 7.7 (High), allows an unauthenticated attacker with local infrastructure access to potentially take over the affected Java components. Exploitation is difficult, requires user interaction, and while impacting Java directly, can significantly affect other products. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
1.6CPE matchmatch criteria
cpe:2.3:a:oracle:jdk:1.6:update_141:*:*:*:*:*:*
1.7CPE matchmatch criteria
cpe:2.3:a:oracle:jdk:1.7:update_131:*:*:*:*:*:*
1.8CPE matchmatch criteria
cpe:2.3:a:oracle:jdk:1.8:update_121:*:*:*:*:*:*
1.6CPE matchmatch criteria
cpe:2.3:a:oracle:jre:1.6:update_141:*:*:*:*:*:*
1.7CPE matchmatch criteria
cpe:2.3:a:oracle:jre:1.7:update_131:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

7.7HIGH

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.0
Impact Score
6.0
CvssVersion
3.0

Exploit Intelligence

EPSS Score
0.76%
Probability of exploitation in next 30 days
EPSS Percentile
51.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0076 is in the 48th percentile among its peer group of 386 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.0 Bluesky, 0.1 Mastodon, and 0.0 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (17)

redhatpatch availablevia redhat_api
Product: Red Hat Satellite 5.8 ELSFixed in: java-1.8.0-ibm-1:1.8.0.5.5-1jpp.1.el6_9
View patch
redhatpatch availablevia redhat_api
Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.8.0-oracle-1:1.8.0.131-1jpp.1.el6
View patch
redhatpatch availablevia redhat_api
Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.7.0-oracle-1:1.7.0.141-1jpp.1.el6
View patch
redhatpatch availablevia redhat_api
Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.8.0-oracle-1:1.8.0.131-1jpp.1.el7_3
View patch
redhatpatch availablevia redhat_api
Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.7.0-oracle-1:1.7.0.141-1jpp.1.el7_3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: java-1.8.0-openjdk-1:1.8.0.131-0.b11.el6_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: java-1.7.0-openjdk-1:1.7.0.141-2.6.10.1.el6_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.8.0-ibm-1:1.8.0.4.5-1jpp.1.el6_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.7.1-ibm-1:1.7.1.4.5-1jpp.2.el6_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: java-1.8.0-openjdk-1:1.8.0.131-2.b11.el7_3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: java-1.7.0-openjdk-1:1.7.0.141-2.6.10.1.el7_3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7 SupplementaryFixed in: java-1.8.0-ibm-1:1.8.0.4.5-1jpp.1.el7_3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7 SupplementaryFixed in: java-1.7.1-ibm-1:1.7.1.4.5-1jpp.1.el7_3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Satellite 5.8Fixed in: java-1.8.0-ibm-1:1.8.0.5.5-1jpp.1.el6_9
View patch
oraclevendor investigatingvia nvd_reference
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: java-1.7.0-openjdk
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: java-1.7.0-oracle

Vendor Advisories (1)

redhatCVE-2017-3511Moderate

OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528)

Apr 18, 2017

References

access.redhat.com / errata/RHSA-2017:1108
access.redhat.com / errata/RHSA-2017:1109
access.redhat.com / errata/RHSA-2017:1117
access.redhat.com / errata/RHSA-2017:1118
access.redhat.com / errata/RHSA-2017:1204
access.redhat.com / errata/RHSA-2017:1220
access.redhat.com / errata/RHSA-2017:1221
access.redhat.com / errata/RHSA-2017:3453
security.gentoo.org / glsa/201705-03
security.gentoo.org / glsa/201707-01
debian.org / security/2017/dsa-3858
oracle.com / technetwork/security-advisory/cpuapr2017-3236618.html
Vendor Advisory
securityfocus.com / bid/97731
Third Party AdvisoryVDB Entry
securitytracker.com / id/1038286