{"id":"CVE-2017-1376","aliases":["EUVD-2017-10392","GHSA-qh9p-7gfq-6xr8","RHSA-2017:2469","RHSA-2017:2481"],"status":"published","title":"A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and...","description":"A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02634,"percentile":0.85633,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-829"],"published":"2017-08-28T20:00:00Z","modified":"2026-06-29T10:17:25Z","affected":[{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.1.el6_9"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.1.el6_9"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.1.el6_9"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.1.el6_9"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.1.el6_9"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.1.el6_9"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.3.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.3.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.3.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.3.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.3.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.4.10-1jpp.3.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.2.el6_9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.2.el6_9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.2.el6_9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.2.el6_9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.2.el6_9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.2.el6_9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.3.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.3.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.3.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.3.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.3.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.10-1jpp.3.el7"}]}],"bundled":17}],"products":[{"vendor":"ibm","product":"operations analytics predictive insights"},{"vendor":"ibm","product":"operations_analytics_predictive_insights"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/126873","tags":["x_refsource_MISC","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2481","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2469","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.ibm.com/support/docview.wss?uid=swg22007305\u0026myns=swgtiv\u0026mynp=OCSSJQQ3\u0026mync=E\u0026cm_sp=swgtiv-_-OCSSJQQ3-_-E","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1376","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qh9p-7gfq-6xr8"},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://developer.ibm.com/javasdk/support/security-vulnerabilities/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471670","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472345","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472666","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472667","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2469.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1483736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1376","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10053","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10067","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10067","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10067","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10078","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10078","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10087","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10087","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10087","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10089","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10090","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10090","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10096","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10101","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10101","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10102","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10102","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10102","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10105","tags":["advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixJAVA","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10107","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10107","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10107","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10108","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10108","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10109","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10109","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10110","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10110","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10110","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10115","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10116","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-10243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10243","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2481.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-1376","description":"A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.","status":"published","published":"2017-08-28T20:00:00Z","modified":"2024-09-16T17:54:40.46Z","updated_at":"2026-11-02T14:33:19.548789Z"}],"euvd":[{"id":"EUVD-2017-10392","description":"A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.","status":"published","published":"2017-08-28T20:00:00Z","modified":"2024-09-16T17:54:40Z","updated_at":"2026-11-03T00:55:37.247006Z"}],"ghsa":[{"id":"GHSA-qh9p-7gfq-6xr8","title":"A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and...","description":"A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.","status":"published","published":"2022-05-13T01:43:15Z","modified":"2023-02-02T05:00:52Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:51:03.910277Z"}],"nvd":[{"id":"CVE-2017-1376","description":"A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.","status":"published","published":"2017-08-29T01:35:13.483Z","modified":"2026-06-17T01:14:20.29Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"RHSA-2017:2469","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T14:41:17Z","modified":"2026-06-29T10:17:22Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:2481","title":"Red Hat Security Advisory: java-1.7.1-ibm security update","status":"published","published":"2024-09-13T14:41:23Z","modified":"2026-06-29T10:17:25Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:04.262457Z"}]}}