USN-3275-2
- Source
- https://ubuntu.com/security/notices/USN-3275-2
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3275-2.json
- JSON Data
- https://api.osv.dev/v1/vulns/USN-3275-2
- Upstream
- Related
- Published
- 2017-05-15T23:50:21Z
- Modified
- 2026-02-10T04:41:07Z
- Summary
- openjdk-7 vulnerabilities
- Details
-
USN-3275-1 fixed vulnerabilities in OpenJDK 8. This update provides the corresponding updates for OpenJDK 7.
Original advisory details:
It was discovered that OpenJDK improperly re-used cached NTLM connections in some situations. A remote attacker could possibly use this to cause a Java application to perform actions with the credentials of a different user. (CVE-2017-3509)
It was discovered that an untrusted library search path flaw existed in the Java Cryptography Extension (JCE) component of OpenJDK. A local attacker could possibly use this to gain the privileges of a Java application. (CVE-2017-3511)
It was discovered that the Java API for XML Processing (JAXP) component in OpenJDK did not properly enforce size limits when parsing XML documents. An attacker could use this to cause a denial of service (processor and memory consumption). (CVE-2017-3526)
It was discovered that the FTP client implementation in OpenJDK did not properly sanitize user inputs. If a user was tricked into opening a specially crafted FTP URL, a remote attacker could use this to manipulate the FTP connection. (CVE-2017-3533)
It was discovered that OpenJDK allowed MD5 to be used as an algorithm for JAR integrity verification. An attacker could possibly use this to modify the contents of a JAR file without detection. (CVE-2017-3539)
It was discovered that the SMTP client implementation in OpenJDK did not properly sanitize sender and recipient addresses. A remote attacker could use this to specially craft email addresses and gain control of a Java application's SMTP connections. (CVE-2017-3544)
- References
Affected packages
Ubuntu:14.04:LTS / openjdk-7
Package
- Name
- openjdk-7
- Purl
- pkg:deb/ubuntu/openjdk-7@7u131-2.6.9-0ubuntu0.14.04.1?arch=source&distro=trusty
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed7u131-2.6.9-0ubuntu0.14.04.1
Affected versions
7u25-2.*
7u45-2.*
7u51-2.*
7u55-2.*
7u65-2.*
7u71-2.*
7u75-2.*
7u79-2.*
7u85-2.*
7u91-2.*
7u95-2.*
7u101-2.*
7u111-2.*
7u121-2.*
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "icedtea-7-jre-jamvm",
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.1"
},
{
"binary_name": "openjdk-7-demo",
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.1"
},
{
"binary_name": "openjdk-7-jdk",
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.1"
},
{
"binary_name": "openjdk-7-jre",
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.1"
},
{
"binary_name": "openjdk-7-jre-headless",
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.1"
},
{
"binary_name": "openjdk-7-jre-lib",
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.1"
},
{
"binary_name": "openjdk-7-jre-zero",
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.1"
},
{
"binary_name": "openjdk-7-source",
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.1"
},
{
"binary_name": "openjdk-7-tests",
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.1"
}
]
}
Database specific
cves_map
{
"ecosystem": "Ubuntu:14.04:LTS",
"cves": [
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2017-3509"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2017-3511"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2017-3526"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
],
"id": "CVE-2017-3533"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
],
"id": "CVE-2017-3539"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
],
"id": "CVE-2017-3544"
}
]
}
source
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3275-2.json"