CVE-2017-3533

14

FAUCET Score

CVE-2017-3533 is a low-severity integrity vulnerability in the Networking subcomponent of Oracle Java SE, Java SE Embedded, and JRockit, affecting versions 6u141, 7u131, 8u121, and R28.3.13 respectively. An unauthenticated attacker with network access via FTP can exploit this difficult-to-exploit flaw to achieve unauthorized data modification. While it impacts both client and server deployments and can be exploited through sandboxed applications or direct API interaction, there is no evidence of active exploitation, public exploit code, or significant community discussion.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		1.6.0CPE matchmatch criteria	cpe:2.3:a:oracle:jdk:1.6.0:update141::::::
		1.7.0CPE matchmatch criteria	cpe:2.3:a:oracle:jdk:1.7.0:update131::::::
		1.8.0CPE matchmatch criteria	cpe:2.3:a:oracle:jdk:1.8.0:update121::::::
		1.6.0CPE matchmatch criteria	cpe:2.3:a:oracle:jre:1.6.0:update141::::::
		1.7.0CPE matchmatch criteria	cpe:2.3:a:oracle:jre:1.7.0:update_131::::::

CVSS Data

CVSS version used by this source: 3.0

3.7LOW

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Exploitability Score

2.2

Impact Score

1.4

CvssVersion

3.0

Exploit Intelligence

EPSS Score

2.58%

Probability of exploitation in next 30 days

EPSS Percentile

83.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0258 is in the 81st percentile among its peer group of 1,506 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (23)

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.8.0-oracle-1:1.8.0.131-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.7.0-oracle-1:1.7.0.141-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.6.0-sun-1:1.6.0.151-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.8.0-oracle-1:1.8.0.131-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.7.0-oracle-1:1.7.0.141-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.6.0-sun-1:1.6.0.151-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: java-1.8.0-openjdk-1:1.8.0.131-0.b11.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: java-1.7.0-openjdk-1:1.7.0.141-2.6.10.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.8.0-ibm-1:1.8.0.4.5-1jpp.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.7.1-ibm-1:1.7.1.4.5-1jpp.2.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.6.0-ibm-1:1.6.0.16.45-1jpp.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: java-1.8.0-openjdk-1:1.8.0.131-2.b11.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: java-1.7.0-openjdk-1:1.7.0.141-2.6.10.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 SupplementaryFixed in: java-1.8.0-ibm-1:1.8.0.4.5-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 SupplementaryFixed in: java-1.7.1-ibm-1:1.7.1.4.5-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 5.8Fixed in: java-1.8.0-ibm-1:1.8.0.5.5-1jpp.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 5.8 ELSFixed in: java-1.8.0-ibm-1:1.8.0.5.5-1jpp.1.el6_9

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.6.0-sun

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.7.0-openjdk

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.7.0-oracle

redhatend of lifevia redhat_api

Product: Red Hat Satellite 5Fixed in: java-1.6.0-ibm

redhatend of lifevia redhat_api

Product: Red Hat Satellite 5Fixed in: java-1.7.1-ibm

Vendor Advisories (1)

redhatCVE-2017-3533Low

OpenJDK: newline injection in the FTP client (Networking, 8170222)

References

access.redhat.com / errata/RHSA-2017:1108

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1109

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1117

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1118

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1119

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1204

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1220

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1221

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1222

Third Party Advisory

access.redhat.com / errata/RHSA-2017:3453

Third Party Advisory

security.gentoo.org / glsa/201705-03

Third Party Advisory

security.gentoo.org / glsa/201707-01

Third Party Advisory

debian.org / security/2017/dsa-3858

Third Party Advisory

oracle.com / technetwork/security-advisory/cpuapr2017-3236618.html

PatchVendor Advisory

securityfocus.com / bid/97740

Third Party AdvisoryVDB Entry

securitytracker.com / id/1038286

Third Party AdvisoryVDB Entry