CVE-2017-1376
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and...
9.8 CriticalFix available
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
2.63%Down 5.0 points since Apr 14, 2021
What each source reports
NVD Score used
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.
- Record
CVE-2017-1376- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-829
- Updated
- 2026-11-02
CVE List No score
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.
- Record
CVE-2017-1376- Updated
- 2026-11-02
EUVDEUVD-2017-10392 No score
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.
- Record
EUVD-2017-10392- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qh9p-7gfq-6xr8
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and...
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.
- Record
GHSA-qh9p-7gfq-6xr8- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-829
- Updated
- 2026-11-02
OSVRHSA-2017:2469
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2017:2469- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2017:2481
Red Hat Security Advisory: java-1.7.1-ibm security update
- Record
RHSA-2017:2481- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibmRed Hat:rhel_extras:6 |
before 1:1.8.0.4.10-1jpp.1.el6_9 | 1:1.8.0.4.10-1jpp.1.el6_9 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:6 |
before 1:1.8.0.4.10-1jpp.1.el6_9 | 1:1.8.0.4.10-1jpp.1.el6_9 |
java-1.8.0-ibm-develRed Hat:rhel_extras:6 |
before 1:1.8.0.4.10-1jpp.1.el6_9 | 1:1.8.0.4.10-1jpp.1.el6_9 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:6 |
before 1:1.8.0.4.10-1jpp.1.el6_9 | 1:1.8.0.4.10-1jpp.1.el6_9 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:6 |
before 1:1.8.0.4.10-1jpp.1.el6_9 | 1:1.8.0.4.10-1jpp.1.el6_9 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:6 |
before 1:1.8.0.4.10-1jpp.1.el6_9 | 1:1.8.0.4.10-1jpp.1.el6_9 |
java-1.8.0-ibmRed Hat:rhel_extras:7 |
before 1:1.8.0.4.10-1jpp.3.el7 | 1:1.8.0.4.10-1jpp.3.el7 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:7 |
before 1:1.8.0.4.10-1jpp.3.el7 | 1:1.8.0.4.10-1jpp.3.el7 |
java-1.8.0-ibm-develRed Hat:rhel_extras:7 |
before 1:1.8.0.4.10-1jpp.3.el7 | 1:1.8.0.4.10-1jpp.3.el7 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:7 |
before 1:1.8.0.4.10-1jpp.3.el7 | 1:1.8.0.4.10-1jpp.3.el7 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibm-pluginRed Hat:rhel_extras:7 |
before 1:1.8.0.4.10-1jpp.3.el7 | 1:1.8.0.4.10-1jpp.3.el7 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:7 |
before 1:1.8.0.4.10-1jpp.3.el7 | 1:1.8.0.4.10-1jpp.3.el7 |
java-1.7.1-ibmRed Hat:rhel_extras:6 |
before 1:1.7.1.4.10-1jpp.2.el6_9 | 1:1.7.1.4.10-1jpp.2.el6_9 |
java-1.7.1-ibm-demoRed Hat:rhel_extras:6 |
before 1:1.7.1.4.10-1jpp.2.el6_9 | 1:1.7.1.4.10-1jpp.2.el6_9 |
java-1.7.1-ibm-develRed Hat:rhel_extras:6 |
before 1:1.7.1.4.10-1jpp.2.el6_9 | 1:1.7.1.4.10-1jpp.2.el6_9 |
java-1.7.1-ibm-jdbcRed Hat:rhel_extras:6 |
before 1:1.7.1.4.10-1jpp.2.el6_9 | 1:1.7.1.4.10-1jpp.2.el6_9 |
java-1.7.1-ibm-pluginRed Hat:rhel_extras:6 |
before 1:1.7.1.4.10-1jpp.2.el6_9 | 1:1.7.1.4.10-1jpp.2.el6_9 |
java-1.7.1-ibm-srcRed Hat:rhel_extras:6 |
before 1:1.7.1.4.10-1jpp.2.el6_9 | 1:1.7.1.4.10-1jpp.2.el6_9 |
java-1.7.1-ibmRed Hat:rhel_extras:7 |
before 1:1.7.1.4.10-1jpp.3.el7 | 1:1.7.1.4.10-1jpp.3.el7 |
java-1.7.1-ibm-demoRed Hat:rhel_extras:7 |
before 1:1.7.1.4.10-1jpp.3.el7 | 1:1.7.1.4.10-1jpp.3.el7 |
java-1.7.1-ibm-develRed Hat:rhel_extras:7 |
before 1:1.7.1.4.10-1jpp.3.el7 | 1:1.7.1.4.10-1jpp.3.el7 |
java-1.7.1-ibm-jdbcRed Hat:rhel_extras:7 |
before 1:1.7.1.4.10-1jpp.3.el7 | 1:1.7.1.4.10-1jpp.3.el7 |
java-1.7.1-ibm-pluginRed Hat:rhel_extras:7 |
before 1:1.7.1.4.10-1jpp.3.el7 | 1:1.7.1.4.10-1jpp.3.el7 |
java-1.7.1-ibm-srcRed Hat:rhel_extras:7 |
before 1:1.7.1.4.10-1jpp.3.el7 | 1:1.7.1.4.10-1jpp.3.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1376 is a critical vulnerability (CVSS 9.8) in Ibm Operations Analytics Predictive Insights, published August 28, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in java-1.8.0-ibm 1:1.8.0.4.10-1jpp.1.el6_9.
References
exchange.xforce.ibmcloud.com/vulnerabilities/126873
access.redhat.com/errata/RHSA-2017:2481
ibm.com/support/docview.wss?uid=swg22007305&myns=swgtiv&mynp=OCSSJQQ3&mync=E&cm_sp=swgtiv-_-OCSSJQQ3-_-E
nvd.nist.gov/vuln/detail/CVE-2017-1376
github.com/advisories/GHSA-qh9p-7gfq-6xr8
Show 76 moreShow less
developer.ibm.com/javasdk/support/security-vulnerabilities
bugzilla.redhat.com/show_bug.cgi?id=1471266
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2469.json
cve.org/CVERecord?id=CVE-2017-1376
oracle.com/technetwork/security-advisory/cpujul2017-3236622.html