CVE-2017-3544

18

FAUCET Score

CVE-2017-3544 is a difficult-to-exploit vulnerability in the Networking subcomponent of Oracle Java SE, Java SE Embedded, and JRockit, affecting versions 6u141, 7u131, 8u121, and R28.3.13 respectively. An unauthenticated attacker with network access via SMTP can compromise these Java components, leading to unauthorized modification or deletion of some accessible data. The CVSS 3.0 Base Score is 3.7 (Low), indicating a low integrity impact with high attack complexity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		1.6.0CPE matchmatch criteria	cpe:2.3:a:oracle:jdk:1.6.0:update141::::::
		1.7.0CPE matchmatch criteria	cpe:2.3:a:oracle:jdk:1.7.0:update131::::::
		1.8.0CPE matchmatch criteria	cpe:2.3:a:oracle:jdk:1.8.0:update121::::::
		1.6.0CPE matchmatch criteria	cpe:2.3:a:oracle:jre:1.6.0:update141::::::
		1.7.0CPE matchmatch criteria	cpe:2.3:a:oracle:jre:1.7.0:update_131::::::

CVSS Data

CVSS version used by this source: 3.0

3.7LOW

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Exploitability Score

2.2

Impact Score

1.4

CvssVersion

3.0

Exploit Intelligence

EPSS Score

1.69%

Probability of exploitation in next 30 days

EPSS Percentile

74.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-26

Model: v2026.06.15

This CVE's current EPSS score of 0.0169 is in the 64th percentile among its peer group of 1,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (24)

googlepatch availablevia nvd_reference

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: java-1.8.0-openjdk-1:1.8.0.131-0.b11.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: java-1.7.0-openjdk-1:1.7.0.141-2.6.10.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 SupplementaryFixed in: java-1.8.0-ibm-1:1.8.0.4.5-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 SupplementaryFixed in: java-1.7.1-ibm-1:1.7.1.4.5-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 5.8Fixed in: java-1.8.0-ibm-1:1.8.0.5.5-1jpp.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 5.8 ELSFixed in: java-1.8.0-ibm-1:1.8.0.5.5-1jpp.1.el6_9

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.8.0-oracle-1:1.8.0.131-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.7.0-oracle-1:1.7.0.141-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 6Fixed in: java-1.6.0-sun-1:1.6.0.151-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.8.0-oracle-1:1.8.0.131-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.7.0-oracle-1:1.7.0.141-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Oracle Java for Red Hat Enterprise Linux 7Fixed in: java-1.6.0-sun-1:1.6.0.151-1jpp.1.el7_3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: java-1.7.0-openjdk-1:1.7.0.141-2.6.10.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.8.0-ibm-1:1.8.0.4.5-1jpp.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.7.1-ibm-1:1.7.1.4.5-1jpp.2.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: java-1.6.0-ibm-1:1.6.0.16.45-1jpp.1.el6_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: java-1.8.0-openjdk-1:1.8.0.131-2.b11.el7_3

redhatend of lifevia redhat_api

Product: Red Hat Satellite 5Fixed in: java-1.7.1-ibm

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.7.0-oracle

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.7.0-openjdk

redhatend of lifevia redhat_api

Product: Red Hat Satellite 5Fixed in: java-1.6.0-ibm

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.6.0-sun

Vendor Advisories (1)

redhatCVE-2017-3544Low

OpenJDK: newline injection in the SMTP client (Networking, 8171533)

References

access.redhat.com / errata/RHSA-2017:1108

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1109

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1117

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1118

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1119

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1204

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1220

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1221

Third Party Advisory

access.redhat.com / errata/RHSA-2017:1222

Third Party Advisory

access.redhat.com / errata/RHSA-2017:3453

Third Party Advisory

security.gentoo.org / glsa/201705-03

Third Party Advisory

security.gentoo.org / glsa/201707-01

Third Party Advisory

source.android.com / security/bulletin/2017-07-01

PatchThird Party Advisory

debian.org / security/2017/dsa-3858

Third Party Advisory

oracle.com / technetwork/security-advisory/cpuapr2017-3236618.html

PatchVendor Advisory

securityfocus.com / bid/97745

Third Party AdvisoryVDB Entry

securitytracker.com / id/1038286

Third Party AdvisoryVDB Entry