How severe is CVE-2017-3242?

CVE-2017-3242 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2017-3242 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-3242?

CVE-2017-3242 primarily affects Oracle Vm Server. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-3242?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-3242 published?

CVE-2017-3242 was published on 2017-01-27 and last updated on 2026-06-17.

CVE-2017-3242

CVE-2017-3242 is a medium-severity vulnerability in Oracle Vm Server with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

Severity: Medium (CVSS 3.x base score 5.9)
CVSS v2: 1.9
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-20
Affected product: Oracle Vm Server
Published: 2017-01-27
Last modified: 2026-06-17

Description

Vulnerability in the Oracle VM Server for Sparc component of Oracle Sun Systems Products Suite (subcomponent: LDOM Manager). Supported versions that are affected are 3.2 and 3.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM Server for Sparc executes to compromise Oracle VM Server for Sparc. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM Server for Sparc, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM Server for Sparc. CVSS v3.0 Base Score 5.9 (Availability impacts).

Frequently asked questions

What is CVE-2017-3242?: Vulnerability in the Oracle VM Server for Sparc component of Oracle Sun Systems Products Suite (subcomponent: LDOM Manager). Supported versions that are affected are 3.2 and 3.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM Server for Sparc executes to compromise Oracle VM Server for Sparc. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM Server for Sparc, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM Server for Sparc. CVSS v3.0 Base Score 5.9 (Availability impacts).
How severe is CVE-2017-3242?: CVE-2017-3242 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2017-3242 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-3242?: CVE-2017-3242 primarily affects Oracle Vm Server. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-3242?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-3242 published?: CVE-2017-3242 was published on 2017-01-27 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:o:oracle:vm_server:3.2:*:*:*:*:*:sparc:*
cpe:2.3:o:oracle:vm_server:3.4:*:*:*:*:*:sparc:*

More vulnerabilities in Oracle Vm Server

CVE-2016-4448 — Critical (CVSS 9.8): Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string…
CVE-2015-8668 — Critical (CVSS 9.8): Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier…
CVE-2014-1490 — Critical (CVSS 9.3): Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before…
CVE-2016-3710 — High (CVSS 8.8): The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest…
CVE-2016-3960 — High (CVSS 8.8): Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host…
CVE-2016-1950 — High (CVSS 8.8): Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before…

All CVEs affecting Oracle Vm Server →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →