Read the docs
TI-2017-01130 Aliases CVE-2017-1376GHSA-qh9p-7gfq-6xr8

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security…

Priority MEDIUM 47CWE-829Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-829.

Summary

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.

Why it matters now

EPSS 0.02634 85th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 8 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMOperations Analytics Predictive Insights1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.5; 1.3.6—No fix listedCNA
  • Operations Analytics Predictive Insights VendorIBM Affected 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.5; 1.3.6 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableIBM
cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableIBM
cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableIBM
cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableIBM
cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.5:*:*:*:*:*:*:*1.3.5VulnerableIBM
cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.6:*:*:*:*:*:*:*1.3.6VulnerableIBM
  • cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operations_analytics_predictive_insights:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·IBM

Remediation

Red Hat 2 advisories

  • RHSA-2017:2481 Released 2017-08-15 · Red Hat rating Critical
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.10-1jpp.3.el7, java-1.7.1-ibm-demo-1:1.7.1.4.10-1jpp.3.el7, java-1.7.1-ibm-devel-1:1.7.1.4.10-1jpp.3.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.10-1jpp.3.el7, java-1.7.1-ibm-demo-1:1.7.1.4.10-1jpp.3.el7, java-1.7.1-ibm-devel-1:1.7.1.4.10-1jpp.3.el7 +1
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.10-1jpp.2.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.10-1jpp.2.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.10-1jpp.2.el6_9 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.10-1jpp.2.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.10-1jpp.2.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.10-1jpp.2.el6_9 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.10-1jpp.2.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.10-1jpp.2.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.10-1jpp.2.el6_9 +3
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.10-1jpp.3.el7, java-1.7.1-ibm-1:1.7.1.4.10-1jpp.3.el7.ppc, java-1.7.1-ibm-demo-1:1.7.1.4.10-1jpp.3.el7 +6
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.10-1jpp.2.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.10-1jpp.2.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.10-1jpp.2.el6_9 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.10-1jpp.3.el7, java-1.7.1-ibm-demo-1:1.7.1.4.10-1jpp.3.el7, java-1.7.1-ibm-devel-1:1.7.1.4.10-1jpp.3.el7 +3
  • RHSA-2017:2469 Released 2017-08-14 · Red Hat rating Critical
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.4.10-1jpp.3.el7, java-1.8.0-ibm-demo-1:1.8.0.4.10-1jpp.3.el7, java-1.8.0-ibm-devel-1:1.8.0.4.10-1jpp.3.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.4.10-1jpp.3.el7, java-1.8.0-ibm-demo-1:1.8.0.4.10-1jpp.3.el7, java-1.8.0-ibm-devel-1:1.8.0.4.10-1jpp.3.el7 +1
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.4.10-1jpp.1.el6_9, java-1.8.0-ibm-demo-1:1.8.0.4.10-1jpp.1.el6_9, java-1.8.0-ibm-devel-1:1.8.0.4.10-1jpp.1.el6_9 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.4.10-1jpp.1.el6_9, java-1.8.0-ibm-demo-1:1.8.0.4.10-1jpp.1.el6_9, java-1.8.0-ibm-devel-1:1.8.0.4.10-1jpp.1.el6_9 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.4.10-1jpp.1.el6_9, java-1.8.0-ibm-demo-1:1.8.0.4.10-1jpp.1.el6_9, java-1.8.0-ibm-devel-1:1.8.0.4.10-1jpp.1.el6_9 +3
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.4.10-1jpp.3.el7, java-1.8.0-ibm-1:1.8.0.4.10-1jpp.3.el7.ppc, java-1.8.0-ibm-demo-1:1.8.0.4.10-1jpp.3.el7 +5
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.4.10-1jpp.1.el6_9, java-1.8.0-ibm-demo-1:1.8.0.4.10-1jpp.1.el6_9, java-1.8.0-ibm-devel-1:1.8.0.4.10-1jpp.1.el6_9 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.4.10-1jpp.3.el7, java-1.8.0-ibm-demo-1:1.8.0.4.10-1jpp.3.el7, java-1.8.0-ibm-devel-1:1.8.0.4.10-1jpp.3.el7 +3

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 5AffectedNo fix yet
Red Hat Enterprise Linux Client Supplementary (v. 7)Fixed RHSA-2017:2469, RHSA-2017:2481
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)Fixed RHSA-2017:2469, RHSA-2017:2481
Red Hat Enterprise Linux Desktop Supplementary (v. 6)Fixed RHSA-2017:2469, RHSA-2017:2481
Red Hat Enterprise Linux HPC Node Supplementary (v. 6)Fixed RHSA-2017:2469, RHSA-2017:2481
Red Hat Enterprise Linux Server Supplementary (v. 6)Fixed RHSA-2017:2469, RHSA-2017:2481
Red Hat Enterprise Linux Server Supplementary (v. 7)Fixed RHSA-2017:2469, RHSA-2017:2481
Red Hat Enterprise Linux Workstation Supplementary (v. 6)Fixed RHSA-2017:2469, RHSA-2017:2481
Red Hat Enterprise Linux Workstation Supplementary (v. 7)Fixed RHSA-2017:2469, RHSA-2017:2481
Not affected: 1 product
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1376
  2. 2026-10-03 Alias added: GHSA-qh9p-7gfq-6xr8

References

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences