Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle
Java SE (subcomponent: Serialization). Supported versions that are affected
are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit:
R28.3.15. Difficult to exploit vulnerability allows unauthenticated
attacker with network access via multiple protocols to compromise Java SE,
Java SE Embedded, JRockit. Successful attacks require human interaction
from a person other than the attacker. Successful attacks of this
vulnerability can result in unauthorized ability to cause a partial denial
of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This
vulnerability can be exploited through sandboxed Java Web Start
applications and sandboxed Java applets. It can also be exploited by
supplying data to APIs in the specified Component without using sandboxed
Java Web Start applications or sandboxed Java applets, such as through a
web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).

Francesco Palmarini, Marco Squarcina, Mauro Tempesta, and Riccardo
Focardi discovered that the Serialization component of OpenJDK did not
properly restrict the amount of memory allocated when deserializing
objects from Java Cryptography Extension KeyStore (JCEKS). An attacker
could use this to cause a denial of service (memory exhaustion).