Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2018-2811
Vulnerability from cvelistv5
Vendor | Product | Version | |
---|---|---|---|
▼ | Oracle Corporation | Java |
Version: Java SE: 8u162 Version: 10 |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T04:29:44.788Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GLSA-201903-14", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201903-14" }, { "name": "1040697", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id/1040697" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20180419-0001/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0" }, { "name": "RHSA-2018:1204", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2018:1204" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html" }, { "name": "RHSA-2018:1202", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2018:1202" }, { "name": "103810", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/103810" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Java", "vendor": "Oracle Corporation", "versions": [ { "status": "affected", "version": "Java SE: 8u162" }, { "status": "affected", "version": "10" } ] } ], "datePublic": "2018-03-27T00:00:00", "descriptions": [ { "lang": "en", "value": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)." } ], "problemTypes": [ { "descriptions": [ { "description": "Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE.", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2019-03-14T09:57:01", "orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle" }, "references": [ { "name": "GLSA-201903-14", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/201903-14" }, { "name": "1040697", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id/1040697" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20180419-0001/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0" }, { "name": "RHSA-2018:1204", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2018:1204" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html" }, { "name": "RHSA-2018:1202", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2018:1202" }, { "name": "103810", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/103810" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2018-2811", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Java", "version": { "version_data": [ { "version_affected": "=", "version_value": "Java SE: 8u162" }, { "version_affected": "=", "version_value": "10" } ] } } ] }, "vendor_name": "Oracle Corporation" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE." } ] } ] }, "references": { "reference_data": [ { "name": "GLSA-201903-14", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201903-14" }, { "name": "1040697", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1040697" }, { "name": "https://security.netapp.com/advisory/ntap-20180419-0001/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20180419-0001/" }, { "name": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0", "refsource": "CONFIRM", "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0" }, { "name": "RHSA-2018:1204", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:1204" }, { "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html" }, { "name": "RHSA-2018:1202", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:1202" }, { "name": "103810", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103810" } ] } } } }, "cveMetadata": { "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "assignerShortName": "oracle", "cveId": "CVE-2018-2811", "datePublished": "2018-04-19T02:00:00", "dateReserved": "2017-12-15T00:00:00", "dateUpdated": "2024-08-05T04:29:44.788Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2018-2811\",\"sourceIdentifier\":\"secalert_us@oracle.com\",\"published\":\"2018-04-19T02:29:04.443\",\"lastModified\":\"2024-11-21T04:04:30.843\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad en el componente Java SE de Oracle Java SE (subcomponente: Install). Las versiones compatibles que se han visto afectadas son JavaSE: 8u162 y 10. Esta vulnerabilidad dif\u00edcilmente explotable permite que un atacante no autenticado con inicio de sesi\u00f3n en la infraestructura en la que se ejecuta Java SE comprometa la seguridad de Java SE. Para que los ataques tengan \u00e9xito, se necesita la participaci\u00f3n de otra persona diferente del atacante y, aunque la vulnerabilidad est\u00e1 presente en Java SE, los ataques podr\u00edan afectar seriamente a productos adicionales. Los ataques exitosos a esta vulnerabilidad pueden resultar en la toma de control de Java SE. Nota: aplica al proceso de instalaci\u00f3n en el despliegue del cliente de Java. CVSS 3.0 Base Score 7.7 (impactos en la confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":6.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:H/Au:N/C:P/I:P/A:P\",\"baseScore\":3.7,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":1.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jdk:1.8.0:update162:*:*:*:*:*:*\",\"matchCriteriaId\":\"4009C7E0-94C7-4838-94CF-5607D7C575CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jdk:10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD0231D6-CA6A-4F76-997A-93AFB840CAF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jre:1.8.0:update162:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F88A87F-D142-4FFD-8121-52FC9A4B70E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jre:10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"095351DA-F50B-4BAF-A4EF-A9C1F8E40E12\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BBCD86A-E6C7-4444-9D74-F861084090F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51EF4996-72F4-4FA4-814F-F5991E7A8318\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5ED5807-55B7-47C5-97A6-03233F4FBC3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"825ECE2D-E232-46E0-A047-074B34DB1E97\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:schneider-electric:struxureware_data_center_expert:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.6.0\",\"matchCriteriaId\":\"6CB56955-1A47-4F6C-A354-8BBAE7534504\"}]}]}],\"references\":[{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/103810\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1040697\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:1202\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:1204\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201903-14\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20180419-0001/\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/103810\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1040697\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:1202\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:1204\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201903-14\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20180419-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
ghsa-688j-c22c-v56f
Vulnerability from github
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
{ "affected": [], "aliases": [ "CVE-2018-2811" ], "database_specific": { "cwe_ids": [], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2018-04-19T02:29:00Z", "severity": "HIGH" }, "details": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", "id": "GHSA-688j-c22c-v56f", "modified": "2022-05-13T01:17:20Z", "published": "2022-05-13T01:17:20Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2811" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2018:1202" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2018:1204" }, { "type": "WEB", "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/201903-14" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20180419-0001" }, { "type": "WEB", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/103810" }, { "type": "WEB", "url": "http://www.securitytracker.com/id/1040697" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
rhsa-2018_1202
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.\n\nThis update upgrades Oracle Java SE 8 to version 8 Update 171.\n\nSecurity Fix(es):\n\n* OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass (Hotspot, 8192025) (CVE-2018-2814)\n\n* OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997) (CVE-2018-2794)\n\n* Oracle JDK: unspecified vulnerability fixed in 8u171 and 10.0.1 (Install) (CVE-2018-2811)\n\n* OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977) (CVE-2018-2795)\n\n* OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981) (CVE-2018-2796)\n\n* OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985) (CVE-2018-2797)\n\n* OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989) (CVE-2018-2798)\n\n* OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993) (CVE-2018-2799)\n\n* OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833) (CVE-2018-2800)\n\n* OpenJDK: unbounded memory allocation during deserialization in StubIORImpl (Serialization, 8192757) (CVE-2018-2815)\n\n* OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969) (CVE-2018-2790)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2018:1202", "url": "https://access.redhat.com/errata/RHSA-2018:1202" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "1567121", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567121" }, { "category": "external", "summary": "1567126", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567126" }, { "category": "external", "summary": "1567351", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567351" }, { "category": "external", "summary": "1567537", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567537" }, { "category": "external", "summary": "1567542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567542" }, { "category": "external", "summary": "1567543", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567543" }, { "category": "external", "summary": "1567545", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567545" }, { "category": "external", "summary": "1567546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567546" }, { "category": "external", "summary": "1568163", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568163" }, { "category": "external", "summary": "1568515", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568515" }, { "category": "external", "summary": "1569203", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1569203" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1202.json" } ], "title": "Red Hat Security Advisory: java-1.8.0-oracle security update", "tracking": { "current_release_date": "2024-11-15T02:07:47+00:00", "generator": { "date": "2024-11-15T02:07:47+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2018:1202", "initial_release_date": "2018-04-23T17:15:03+00:00", "revision_history": [ { "date": "2018-04-23T17:15:03+00:00", "number": "1", "summary": "Initial version" }, { "date": "2018-04-23T17:15:03+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T02:07:47+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Java for Red Hat Enterprise Linux Desktop 6", "product": { "name": "Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras_oracle_java:6" } } }, { "category": "product_name", "name": "Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product": { "name": "Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras_oracle_java:6" } } }, { "category": "product_name", "name": "Oracle Java for Red Hat Enterprise Linux Server 6", "product": { "name": "Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras_oracle_java:6" } } }, { "category": "product_name", "name": "Oracle Java for Red Hat Enterprise Linux Workstation 6", "product": { "name": "Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras_oracle_java:6" } } } ], "category": "product_family", "name": "Oracle Java for Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "product": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "product_id": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-javafx@1.8.0.171-1jpp.2.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "product": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "product_id": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-src@1.8.0.171-1jpp.2.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "product": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "product_id": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-jdbc@1.8.0.171-1jpp.2.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "product": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "product_id": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle@1.8.0.171-1jpp.2.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "product": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "product_id": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-plugin@1.8.0.171-1jpp.2.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "product": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "product_id": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-devel@1.8.0.171-1jpp.2.el6?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "product": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "product_id": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-javafx@1.8.0.171-1jpp.2.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "product": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "product_id": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-src@1.8.0.171-1jpp.2.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "product": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "product_id": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-jdbc@1.8.0.171-1jpp.2.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "product": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "product_id": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle@1.8.0.171-1jpp.2.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "product": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "product_id": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-plugin@1.8.0.171-1jpp.2.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "product": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "product_id": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-devel@1.8.0.171-1jpp.2.el6?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Desktop 6", "product_id": "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Client-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux HPC Node 6", "product_id": "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6ComputeNode-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server 6", "product_id": "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Server-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation 6", "product_id": "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "relates_to_product_reference": "6Workstation-OracleJava-6.9.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-2790", "cwe": { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568515" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2790" }, { "category": "external", "summary": "RHBZ#1568515", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568515" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2790", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2790" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2790", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2790" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969)" }, { "cve": "CVE-2018-2794", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567126" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, JRockit executes to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2794" }, { "category": "external", "summary": "RHBZ#1567126", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567126" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2794", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2794" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2794", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2794" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997)" }, { "cve": "CVE-2018-2795", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567351" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2795" }, { "category": "external", "summary": "RHBZ#1567351", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567351" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2795", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2795" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2795", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2795" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977)" }, { "cve": "CVE-2018-2796", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567546" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2796" }, { "category": "external", "summary": "RHBZ#1567546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567546" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2796", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2796" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2796", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2796" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981)" }, { "cve": "CVE-2018-2797", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567545" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2797" }, { "category": "external", "summary": "RHBZ#1567545", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567545" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2797", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2797" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985)" }, { "cve": "CVE-2018-2798", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567543" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2798" }, { "category": "external", "summary": "RHBZ#1567543", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567543" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2798", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2798" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989)" }, { "cve": "CVE-2018-2799", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567542" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2799" }, { "category": "external", "summary": "RHBZ#1567542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567542" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2799", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2799" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2799", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2799" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993)" }, { "cve": "CVE-2018-2800", "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568163" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, JRockit accessible data as well as unauthorized read access to a subset of Java SE, JRockit accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2800" }, { "category": "external", "summary": "RHBZ#1568163", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568163" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2800", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2800" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833)" }, { "cve": "CVE-2018-2811", "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1569203" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: unspecified vulnerability fixed in 8u171 and 10.0.1 (Install)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2811" }, { "category": "external", "summary": "RHBZ#1569203", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1569203" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2811", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2811" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2811", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2811" }, { "category": "external", "summary": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: unspecified vulnerability fixed in 8u171 and 10.0.1 (Install)" }, { "cve": "CVE-2018-2814", "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567121" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass (Hotspot, 8192025)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2814" }, { "category": "external", "summary": "RHBZ#1567121", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567121" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2814", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2814" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2814", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2814" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass (Hotspot, 8192025)" }, { "cve": "CVE-2018-2815", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567537" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unbounded memory allocation during deserialization in StubIORImpl (Serialization, 8192757)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2815" }, { "category": "external", "summary": "RHBZ#1567537", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567537" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2815", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2815" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2815", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2815" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T17:15:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1202" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Client-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6ComputeNode-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Server-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.2.el6.x86_64", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.i686", "6Workstation-OracleJava-6.9.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.2.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: unbounded memory allocation during deserialization in StubIORImpl (Serialization, 8192757)" } ] }
rhsa-2018_1204
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.\n\nThis update upgrades Oracle Java SE 8 to version 8 Update 171.\n\nSecurity Fix(es):\n\n* OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass (Hotspot, 8192025) (CVE-2018-2814)\n\n* OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997) (CVE-2018-2794)\n\n* Oracle JDK: unspecified vulnerability fixed in 8u171 and 10.0.1 (Install) (CVE-2018-2811)\n\n* OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977) (CVE-2018-2795)\n\n* OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981) (CVE-2018-2796)\n\n* OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985) (CVE-2018-2797)\n\n* OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989) (CVE-2018-2798)\n\n* OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993) (CVE-2018-2799)\n\n* OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833) (CVE-2018-2800)\n\n* OpenJDK: unbounded memory allocation during deserialization in StubIORImpl (Serialization, 8192757) (CVE-2018-2815)\n\n* OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969) (CVE-2018-2790)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2018:1204", "url": "https://access.redhat.com/errata/RHSA-2018:1204" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "1567121", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567121" }, { "category": "external", "summary": "1567126", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567126" }, { "category": "external", "summary": "1567351", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567351" }, { "category": "external", "summary": "1567537", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567537" }, { "category": "external", "summary": "1567542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567542" }, { "category": "external", "summary": "1567543", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567543" }, { "category": "external", "summary": "1567545", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567545" }, { "category": "external", "summary": "1567546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567546" }, { "category": "external", "summary": "1568163", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568163" }, { "category": "external", "summary": "1568515", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568515" }, { "category": "external", "summary": "1569203", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1569203" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1204.json" } ], "title": "Red Hat Security Advisory: java-1.8.0-oracle security update", "tracking": { "current_release_date": "2024-11-15T02:08:13+00:00", "generator": { "date": "2024-11-15T02:08:13+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2018:1204", "initial_release_date": "2018-04-23T22:53:51+00:00", "revision_history": [ { "date": "2018-04-23T22:53:51+00:00", "number": "1", "summary": "Initial version" }, { "date": "2018-04-23T22:53:51+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T02:08:13+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Java for Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Oracle Java for Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-OracleJava-7.5.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras_oracle_java:7" } } }, { "category": "product_name", "name": "Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7)", "product": { "name": "Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7)", "product_id": "7ComputeNode-OracleJava-7.5.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras_oracle_java:7" } } }, { "category": "product_name", "name": "Oracle Java for Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Oracle Java for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-OracleJava-7.5.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras_oracle_java:7" } } }, { "category": "product_name", "name": "Oracle Java for Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Oracle Java for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-OracleJava-7.5.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras_oracle_java:7" } } } ], "category": "product_family", "name": "Oracle Java for Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-plugin@1.8.0.171-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-devel@1.8.0.171-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-jdbc@1.8.0.171-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-javafx@1.8.0.171-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle@1.8.0.171-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-oracle-src@1.8.0.171-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7)", "product_id": "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7)", "product_id": "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7)", "product_id": "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7)", "product_id": "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7)", "product_id": "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7)", "product_id": "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-OracleJava-7.5.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64 as a component of Oracle Java for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-OracleJava-7.5.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-2790", "cwe": { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568515" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2790" }, { "category": "external", "summary": "RHBZ#1568515", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568515" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2790", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2790" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2790", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2790" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969)" }, { "cve": "CVE-2018-2794", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567126" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, JRockit executes to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2794" }, { "category": "external", "summary": "RHBZ#1567126", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567126" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2794", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2794" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2794", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2794" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997)" }, { "cve": "CVE-2018-2795", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567351" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2795" }, { "category": "external", "summary": "RHBZ#1567351", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567351" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2795", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2795" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2795", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2795" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977)" }, { "cve": "CVE-2018-2796", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567546" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2796" }, { "category": "external", "summary": "RHBZ#1567546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567546" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2796", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2796" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2796", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2796" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981)" }, { "cve": "CVE-2018-2797", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567545" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2797" }, { "category": "external", "summary": "RHBZ#1567545", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567545" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2797", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2797" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985)" }, { "cve": "CVE-2018-2798", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567543" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2798" }, { "category": "external", "summary": "RHBZ#1567543", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567543" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2798", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2798" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989)" }, { "cve": "CVE-2018-2799", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567542" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2799" }, { "category": "external", "summary": "RHBZ#1567542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567542" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2799", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2799" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2799", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2799" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993)" }, { "cve": "CVE-2018-2800", "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568163" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, JRockit accessible data as well as unauthorized read access to a subset of Java SE, JRockit accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2800" }, { "category": "external", "summary": "RHBZ#1568163", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568163" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2800", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2800" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833)" }, { "cve": "CVE-2018-2811", "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1569203" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: unspecified vulnerability fixed in 8u171 and 10.0.1 (Install)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2811" }, { "category": "external", "summary": "RHBZ#1569203", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1569203" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2811", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2811" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2811", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2811" }, { "category": "external", "summary": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: unspecified vulnerability fixed in 8u171 and 10.0.1 (Install)" }, { "cve": "CVE-2018-2814", "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567121" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass (Hotspot, 8192025)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2814" }, { "category": "external", "summary": "RHBZ#1567121", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567121" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2814", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2814" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2814", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2814" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass (Hotspot, 8192025)" }, { "cve": "CVE-2018-2815", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2018-03-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1567537" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: unbounded memory allocation during deserialization in StubIORImpl (Serialization, 8192757)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-2815" }, { "category": "external", "summary": "RHBZ#1567537", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567537" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-2815", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2815" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-2815", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2815" } ], "release_date": "2018-04-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-04-23T22:53:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Oracle Java must be restarted for this update to take effect.", "product_ids": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:1204" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Client-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7ComputeNode-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Server-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-devel-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-javafx-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-jdbc-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-plugin-1:1.8.0.171-1jpp.1.el7.x86_64", "7Workstation-OracleJava-7.5.Z:java-1.8.0-oracle-src-1:1.8.0.171-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: unbounded memory allocation during deserialization in StubIORImpl (Serialization, 8192757)" } ] }
WID-SEC-W-2023-1375
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).\r\nJava Standard Edition (SE) Embedded ist die Laufzeitumgebung f\u00fcr die Java-Plattform des US-Unternehmens Oracle Corporation f\u00fcr Embedded Systems.\r\nOracle JRockit JVM ist eine leistungsf\u00e4hige Java Virtual Machine, die in Oracle Fusion Middleware enthalten ist.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit ausnutzen, um die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- F5 Networks", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1375 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2018/wid-sec-w-2023-1375.json" }, { "category": "self", "summary": "WID-SEC-2023-1375 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1375" }, { "category": "external", "summary": "IBM Security Bulletin 7001787 vom 2023-06-07", "url": "https://www.ibm.com/support/pages/node/7001787" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - April 2018 vom 2018-04-17", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA" }, { "category": "external", "summary": "NetApp Security Advisory NTAP-20180419-0001 vom 2018-04-20", "url": "https://security.netapp.com/advisory/ntap-20180419-0001/" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2018-1191 vom 2018-04-20", "url": "http://linux.oracle.com/errata/ELSA-2018-1191.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2018-1188 vom 2018-04-20", "url": "http://linux.oracle.com/errata/ELSA-2018-1188.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1201 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1201" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1204 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1204" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1206 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1206" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1202 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1202" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1205 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1205" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1203 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1203" }, { "category": "external", "summary": "Debian Security Advisory DSA-4185 vom 2018-04-29", "url": "https://www.debian.org/security/2018/dsa-4185" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2018-1270 vom 2018-05-01", "url": "http://linux.oracle.com/errata/ELSA-2018-1270.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1270 vom 2018-04-30", "url": "https://access.redhat.com/errata/RHSA-2018:1270" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1188", "url": "https://access.redhat.com/errata/RHSA-2018:1188" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2018-1278 vom 2018-05-03", "url": "http://linux.oracle.com/errata/ELSA-2018-1278.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1278 vom 2018-05-03", "url": "https://access.redhat.com/errata/RHSA-2018:1278" }, { "category": "external", "summary": "CentOS Security Advisory CESA-2018:1270 vom 2018-05-02", "url": "http://centos-announce.2309468.n4.nabble.com/CentOS-announce-CESA-2018-1270-Important-CentOS-6-java-1-7-0-openjdk-Security-Update-tp4645024.html" }, { "category": "external", "summary": "McAfee Security Bulletin", "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10234" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1724 vom 2018-05-24", "url": "http://rhn.redhat.com/errata/RHSA-2018-1724.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1723 vom 2018-05-24", "url": "http://rhn.redhat.com/errata/RHSA-2018-1723.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1722 vom 2018-05-24", "url": "http://rhn.redhat.com/errata/RHSA-2018-1722.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1721 vom 2018-05-24", "url": "http://rhn.redhat.com/errata/RHSA-2018-1721.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1447-1 vom 2018-05-29", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181447-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1458-1 vom 2018-05-29", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181458-1.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-4225 vom 2018-06-11", "url": "https://www.debian.org/security/2018/dsa-4225" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1692-1 vom 2018-06-14", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181692-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1690-1 vom 2018-06-14", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181690-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1738-1 vom 2018-06-20", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181738-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1764-1 vom 2018-06-20", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181764-1.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1975 vom 2018-06-25", "url": "http://rhn.redhat.com/errata/RHSA-2018-1975.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1974 vom 2018-06-25", "url": "http://rhn.redhat.com/errata/RHSA-2018-1974.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1938-1 vom 2018-07-13", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181938-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1938-2 vom 2018-07-13", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181938-2.html" }, { "category": "external", "summary": "F5 Security Advisory K15217245 vom 2018-09-19", "url": "https://support.f5.com/csp/article/K15217245" }, { "category": "external", "summary": "F5 Security Advisory K44923228 Stand 2018-09.20", "url": "https://support.f5.com/csp/article/K44923228" }, { "category": "external", "summary": "F5 Security Advisory K33924005 Stand 2018-09.20", "url": "https://support.f5.com/csp/article/K33924005" }, { "category": "external", "summary": "F5 Security Advisory K70321874 vom 2018-12-18", "url": "https://support.f5.com/csp/article/K70321874" }, { "category": "external", "summary": "Dell/EMC Knowledge Base Article: 000529947", "url": "https://support.emc.com/kb/529947" } ], "source_lang": "en-US", "title": "Oracle Java SE: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-06-06T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:30:00.301+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1375", "initial_release_date": "2018-04-17T22:00:00.000+00:00", "revision_history": [ { "date": "2018-04-17T22:00:00.000+00:00", "number": "1", "summary": "Initial Release" }, { "date": "2018-04-17T22:00:00.000+00:00", "number": "2", "summary": "Version nicht vorhanden" }, { "date": "2018-04-19T22:00:00.000+00:00", "number": "3", "summary": "New remediations available" }, { "date": "2018-04-19T22:00:00.000+00:00", "number": "4", "summary": "Version nicht vorhanden" }, { "date": "2018-04-23T22:00:00.000+00:00", "number": "5", "summary": "New remediations available" }, { "date": "2018-04-29T22:00:00.000+00:00", "number": "6", "summary": "New remediations available" }, { "date": "2018-05-01T22:00:00.000+00:00", "number": "7", "summary": "New remediations available" }, { "date": "2018-05-01T22:00:00.000+00:00", "number": "8", "summary": "New remediations available" }, { "date": "2018-05-02T22:00:00.000+00:00", "number": "9", "summary": "New remediations available" }, { "date": "2018-05-02T22:00:00.000+00:00", "number": "10", "summary": "New remediations available" }, { "date": "2018-05-07T22:00:00.000+00:00", "number": "11", "summary": "New remediations available" }, { "date": "2018-05-07T22:00:00.000+00:00", "number": "12", "summary": "Version nicht vorhanden" }, { "date": "2018-05-24T22:00:00.000+00:00", "number": "13", "summary": "New remediations available" }, { "date": "2018-05-28T22:00:00.000+00:00", "number": "14", "summary": "New remediations available" }, { "date": "2018-05-29T22:00:00.000+00:00", "number": "15", "summary": "New remediations available" }, { "date": "2018-06-11T22:00:00.000+00:00", "number": "16", "summary": "New remediations available" }, { "date": "2018-06-14T22:00:00.000+00:00", "number": "17", "summary": "New remediations available" }, { "date": "2018-06-19T22:00:00.000+00:00", "number": "18", "summary": "New remediations available" }, { "date": "2018-06-20T22:00:00.000+00:00", "number": "19", "summary": "New remediations available" }, { "date": "2018-06-25T22:00:00.000+00:00", "number": "20", "summary": "New remediations available" }, { "date": "2018-07-12T22:00:00.000+00:00", "number": "21", "summary": "New remediations available" }, { "date": "2018-09-19T22:00:00.000+00:00", "number": "22", "summary": "New remediations available" }, { "date": "2018-09-19T22:00:00.000+00:00", "number": "23", "summary": "Version nicht vorhanden" }, { "date": "2018-09-19T22:00:00.000+00:00", "number": "24", "summary": "Version nicht vorhanden" }, { "date": "2018-12-18T23:00:00.000+00:00", "number": "25", "summary": "New remediations available" }, { "date": "2019-01-30T23:00:00.000+00:00", "number": "26", "summary": "Neue Updates von EMC aufgenommen" }, { "date": "2023-06-06T22:00:00.000+00:00", "number": "27", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "27" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "EMC VNX2", "product": { "name": "EMC VNX2", "product_id": "T004667", "product_identification_helper": { "cpe": "cpe:/h:emc:vnx:-" } } } ], "category": "vendor", "name": "EMC" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP", "product": { "name": "F5 BIG-IP", "product_id": "T001663", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip:-" } } } ], "category": "vendor", "name": "F5" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "IBM Operational Decision Manager 8.10.x", "product": { "name": "IBM Operational Decision Manager 8.10.x", "product_id": "T027827", "product_identification_helper": { "cpe": "cpe:/a:ibm:operational_decision_manager:8.10.x" } } }, { "category": "product_name", "name": "IBM Operational Decision Manager 8.11.x", "product": { "name": "IBM Operational Decision Manager 8.11.x", "product_id": "T027828", "product_identification_helper": { "cpe": "cpe:/a:ibm:operational_decision_manager:8.11.x" } } } ], "category": "product_name", "name": "Operational Decision Manager" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.3.1", "product": { "name": "McAfee ePolicy Orchestrator 5.3.1", "product_id": "318532", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.3.1" } } }, { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.3.2", "product": { "name": "McAfee ePolicy Orchestrator 5.3.2", "product_id": "T009959", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.3.2" } } }, { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.9.0", "product": { "name": "McAfee ePolicy Orchestrator 5.9.0", "product_id": "T009960", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.9.0" } } }, { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.3.3", "product": { "name": "McAfee ePolicy Orchestrator 5.3.3", "product_id": "T012223", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.3.3" } } }, { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.3.0", "product": { "name": "McAfee ePolicy Orchestrator 5.3.0", "product_id": "T012224", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.3.0" } } }, { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.9.1", "product": { "name": "McAfee ePolicy Orchestrator 5.9.1", "product_id": "T012225", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.9.1" } } } ], "category": "product_name", "name": "ePolicy Orchestrator" } ], "category": "vendor", "name": "McAfee" }, { "branches": [ { "category": "product_name", "name": "NetApp OnCommand Unified Manager 7.2", "product": { "name": "NetApp OnCommand Unified Manager 7.2", "product_id": "T011994", "product_identification_helper": { "cpe": "cpe:/a:netapp:oncommand_unified_manager:7.2" } } } ], "category": "vendor", "name": "NetApp" }, { "branches": [ { "category": "product_name", "name": "Open Source CentOS", "product": { "name": "Open Source CentOS", "product_id": "1727", "product_identification_helper": { "cpe": "cpe:/o:centos:centos:-" } } } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Java SE 7u161", "product": { "name": "Oracle Java SE 7u161", "product_id": "T011621", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:7u161" } } }, { "category": "product_name", "name": "Oracle Java SE 8u152", "product": { "name": "Oracle Java SE 8u152", "product_id": "T011623", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:8u152" } } }, { "category": "product_name", "name": "Oracle Java SE 10", "product": { "name": "Oracle Java SE 10", "product_id": "T012136", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:10" } } }, { "category": "product_name", "name": "Oracle Java SE 8u162", "product": { "name": "Oracle Java SE 8u162", "product_id": "T012137", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:8u162" } } }, { "category": "product_name", "name": "Oracle Java SE 7u171", "product": { "name": "Oracle Java SE 7u171", "product_id": "T012138", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:7u171" } } }, { "category": "product_name", "name": "Oracle Java SE 6u181", "product": { "name": "Oracle Java SE 6u181", "product_id": "T012139", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:6u181" } } } ], "category": "product_name", "name": "Java SE" }, { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "F5 Enterprise Manager", "product": { "name": "F5 Enterprise Manager", "product_id": "T000125", "product_identification_helper": { "cpe": "cpe:/a:f5:enterprise_manager:-" } } } ], "category": "vendor", "name": "f5" }, { "branches": [ { "category": "product_name", "name": "Oracle Java SE Embedded 8u161", "product": { "name": "Oracle Java SE Embedded 8u161", "product_id": "T002043", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se_embedded:7.0:update_40" } } }, { "category": "product_name", "name": "Oracle JRockit R28.3.17", "product": { "name": "Oracle JRockit R28.3.17", "product_id": "T012140", "product_identification_helper": { "cpe": "cpe:/a:oracle:jrockit:r28.3.17" } } } ], "category": "vendor", "name": "oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-2783", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2783" }, { "cve": "CVE-2018-2790", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2790" }, { "cve": "CVE-2018-2794", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2794" }, { "cve": "CVE-2018-2795", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2795" }, { "cve": "CVE-2018-2796", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2796" }, { "cve": "CVE-2018-2797", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2797" }, { "cve": "CVE-2018-2798", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2798" }, { "cve": "CVE-2018-2799", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2799" }, { "cve": "CVE-2018-2800", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2800" }, { "cve": "CVE-2018-2811", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2811" }, { "cve": "CVE-2018-2814", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2814" }, { "cve": "CVE-2018-2815", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2815" }, { "cve": "CVE-2018-2825", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2825" }, { "cve": "CVE-2018-2826", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2826" } ] }
wid-sec-w-2023-1375
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).\r\nJava Standard Edition (SE) Embedded ist die Laufzeitumgebung f\u00fcr die Java-Plattform des US-Unternehmens Oracle Corporation f\u00fcr Embedded Systems.\r\nOracle JRockit JVM ist eine leistungsf\u00e4hige Java Virtual Machine, die in Oracle Fusion Middleware enthalten ist.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit ausnutzen, um die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- F5 Networks", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1375 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2018/wid-sec-w-2023-1375.json" }, { "category": "self", "summary": "WID-SEC-2023-1375 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1375" }, { "category": "external", "summary": "IBM Security Bulletin 7001787 vom 2023-06-07", "url": "https://www.ibm.com/support/pages/node/7001787" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - April 2018 vom 2018-04-17", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA" }, { "category": "external", "summary": "NetApp Security Advisory NTAP-20180419-0001 vom 2018-04-20", "url": "https://security.netapp.com/advisory/ntap-20180419-0001/" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2018-1191 vom 2018-04-20", "url": "http://linux.oracle.com/errata/ELSA-2018-1191.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2018-1188 vom 2018-04-20", "url": "http://linux.oracle.com/errata/ELSA-2018-1188.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1201 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1201" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1204 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1204" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1206 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1206" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1202 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1202" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1205 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1205" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1203 vom 2018-04-24", "url": "https://access.redhat.com/errata/RHSA-2018:1203" }, { "category": "external", "summary": "Debian Security Advisory DSA-4185 vom 2018-04-29", "url": "https://www.debian.org/security/2018/dsa-4185" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2018-1270 vom 2018-05-01", "url": "http://linux.oracle.com/errata/ELSA-2018-1270.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1270 vom 2018-04-30", "url": "https://access.redhat.com/errata/RHSA-2018:1270" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1188", "url": "https://access.redhat.com/errata/RHSA-2018:1188" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2018-1278 vom 2018-05-03", "url": "http://linux.oracle.com/errata/ELSA-2018-1278.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1278 vom 2018-05-03", "url": "https://access.redhat.com/errata/RHSA-2018:1278" }, { "category": "external", "summary": "CentOS Security Advisory CESA-2018:1270 vom 2018-05-02", "url": "http://centos-announce.2309468.n4.nabble.com/CentOS-announce-CESA-2018-1270-Important-CentOS-6-java-1-7-0-openjdk-Security-Update-tp4645024.html" }, { "category": "external", "summary": "McAfee Security Bulletin", "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10234" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1724 vom 2018-05-24", "url": "http://rhn.redhat.com/errata/RHSA-2018-1724.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1723 vom 2018-05-24", "url": "http://rhn.redhat.com/errata/RHSA-2018-1723.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1722 vom 2018-05-24", "url": "http://rhn.redhat.com/errata/RHSA-2018-1722.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1721 vom 2018-05-24", "url": "http://rhn.redhat.com/errata/RHSA-2018-1721.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1447-1 vom 2018-05-29", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181447-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1458-1 vom 2018-05-29", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181458-1.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-4225 vom 2018-06-11", "url": "https://www.debian.org/security/2018/dsa-4225" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1692-1 vom 2018-06-14", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181692-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1690-1 vom 2018-06-14", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181690-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1738-1 vom 2018-06-20", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181738-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1764-1 vom 2018-06-20", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181764-1.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1975 vom 2018-06-25", "url": "http://rhn.redhat.com/errata/RHSA-2018-1975.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2018:1974 vom 2018-06-25", "url": "http://rhn.redhat.com/errata/RHSA-2018-1974.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1938-1 vom 2018-07-13", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181938-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:1938-2 vom 2018-07-13", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181938-2.html" }, { "category": "external", "summary": "F5 Security Advisory K15217245 vom 2018-09-19", "url": "https://support.f5.com/csp/article/K15217245" }, { "category": "external", "summary": "F5 Security Advisory K44923228 Stand 2018-09.20", "url": "https://support.f5.com/csp/article/K44923228" }, { "category": "external", "summary": "F5 Security Advisory K33924005 Stand 2018-09.20", "url": "https://support.f5.com/csp/article/K33924005" }, { "category": "external", "summary": "F5 Security Advisory K70321874 vom 2018-12-18", "url": "https://support.f5.com/csp/article/K70321874" }, { "category": "external", "summary": "Dell/EMC Knowledge Base Article: 000529947", "url": "https://support.emc.com/kb/529947" } ], "source_lang": "en-US", "title": "Oracle Java SE: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-06-06T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:30:00.301+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1375", "initial_release_date": "2018-04-17T22:00:00.000+00:00", "revision_history": [ { "date": "2018-04-17T22:00:00.000+00:00", "number": "1", "summary": "Initial Release" }, { "date": "2018-04-17T22:00:00.000+00:00", "number": "2", "summary": "Version nicht vorhanden" }, { "date": "2018-04-19T22:00:00.000+00:00", "number": "3", "summary": "New remediations available" }, { "date": "2018-04-19T22:00:00.000+00:00", "number": "4", "summary": "Version nicht vorhanden" }, { "date": "2018-04-23T22:00:00.000+00:00", "number": "5", "summary": "New remediations available" }, { "date": "2018-04-29T22:00:00.000+00:00", "number": "6", "summary": "New remediations available" }, { "date": "2018-05-01T22:00:00.000+00:00", "number": "7", "summary": "New remediations available" }, { "date": "2018-05-01T22:00:00.000+00:00", "number": "8", "summary": "New remediations available" }, { "date": "2018-05-02T22:00:00.000+00:00", "number": "9", "summary": "New remediations available" }, { "date": "2018-05-02T22:00:00.000+00:00", "number": "10", "summary": "New remediations available" }, { "date": "2018-05-07T22:00:00.000+00:00", "number": "11", "summary": "New remediations available" }, { "date": "2018-05-07T22:00:00.000+00:00", "number": "12", "summary": "Version nicht vorhanden" }, { "date": "2018-05-24T22:00:00.000+00:00", "number": "13", "summary": "New remediations available" }, { "date": "2018-05-28T22:00:00.000+00:00", "number": "14", "summary": "New remediations available" }, { "date": "2018-05-29T22:00:00.000+00:00", "number": "15", "summary": "New remediations available" }, { "date": "2018-06-11T22:00:00.000+00:00", "number": "16", "summary": "New remediations available" }, { "date": "2018-06-14T22:00:00.000+00:00", "number": "17", "summary": "New remediations available" }, { "date": "2018-06-19T22:00:00.000+00:00", "number": "18", "summary": "New remediations available" }, { "date": "2018-06-20T22:00:00.000+00:00", "number": "19", "summary": "New remediations available" }, { "date": "2018-06-25T22:00:00.000+00:00", "number": "20", "summary": "New remediations available" }, { "date": "2018-07-12T22:00:00.000+00:00", "number": "21", "summary": "New remediations available" }, { "date": "2018-09-19T22:00:00.000+00:00", "number": "22", "summary": "New remediations available" }, { "date": "2018-09-19T22:00:00.000+00:00", "number": "23", "summary": "Version nicht vorhanden" }, { "date": "2018-09-19T22:00:00.000+00:00", "number": "24", "summary": "Version nicht vorhanden" }, { "date": "2018-12-18T23:00:00.000+00:00", "number": "25", "summary": "New remediations available" }, { "date": "2019-01-30T23:00:00.000+00:00", "number": "26", "summary": "Neue Updates von EMC aufgenommen" }, { "date": "2023-06-06T22:00:00.000+00:00", "number": "27", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "27" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "EMC VNX2", "product": { "name": "EMC VNX2", "product_id": "T004667", "product_identification_helper": { "cpe": "cpe:/h:emc:vnx:-" } } } ], "category": "vendor", "name": "EMC" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP", "product": { "name": "F5 BIG-IP", "product_id": "T001663", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip:-" } } } ], "category": "vendor", "name": "F5" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "IBM Operational Decision Manager 8.10.x", "product": { "name": "IBM Operational Decision Manager 8.10.x", "product_id": "T027827", "product_identification_helper": { "cpe": "cpe:/a:ibm:operational_decision_manager:8.10.x" } } }, { "category": "product_name", "name": "IBM Operational Decision Manager 8.11.x", "product": { "name": "IBM Operational Decision Manager 8.11.x", "product_id": "T027828", "product_identification_helper": { "cpe": "cpe:/a:ibm:operational_decision_manager:8.11.x" } } } ], "category": "product_name", "name": "Operational Decision Manager" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.3.1", "product": { "name": "McAfee ePolicy Orchestrator 5.3.1", "product_id": "318532", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.3.1" } } }, { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.3.2", "product": { "name": "McAfee ePolicy Orchestrator 5.3.2", "product_id": "T009959", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.3.2" } } }, { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.9.0", "product": { "name": "McAfee ePolicy Orchestrator 5.9.0", "product_id": "T009960", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.9.0" } } }, { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.3.3", "product": { "name": "McAfee ePolicy Orchestrator 5.3.3", "product_id": "T012223", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.3.3" } } }, { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.3.0", "product": { "name": "McAfee ePolicy Orchestrator 5.3.0", "product_id": "T012224", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.3.0" } } }, { "category": "product_name", "name": "McAfee ePolicy Orchestrator 5.9.1", "product": { "name": "McAfee ePolicy Orchestrator 5.9.1", "product_id": "T012225", "product_identification_helper": { "cpe": "cpe:/a:mcafee:epolicy_orchestrator:5.9.1" } } } ], "category": "product_name", "name": "ePolicy Orchestrator" } ], "category": "vendor", "name": "McAfee" }, { "branches": [ { "category": "product_name", "name": "NetApp OnCommand Unified Manager 7.2", "product": { "name": "NetApp OnCommand Unified Manager 7.2", "product_id": "T011994", "product_identification_helper": { "cpe": "cpe:/a:netapp:oncommand_unified_manager:7.2" } } } ], "category": "vendor", "name": "NetApp" }, { "branches": [ { "category": "product_name", "name": "Open Source CentOS", "product": { "name": "Open Source CentOS", "product_id": "1727", "product_identification_helper": { "cpe": "cpe:/o:centos:centos:-" } } } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Java SE 7u161", "product": { "name": "Oracle Java SE 7u161", "product_id": "T011621", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:7u161" } } }, { "category": "product_name", "name": "Oracle Java SE 8u152", "product": { "name": "Oracle Java SE 8u152", "product_id": "T011623", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:8u152" } } }, { "category": "product_name", "name": "Oracle Java SE 10", "product": { "name": "Oracle Java SE 10", "product_id": "T012136", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:10" } } }, { "category": "product_name", "name": "Oracle Java SE 8u162", "product": { "name": "Oracle Java SE 8u162", "product_id": "T012137", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:8u162" } } }, { "category": "product_name", "name": "Oracle Java SE 7u171", "product": { "name": "Oracle Java SE 7u171", "product_id": "T012138", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:7u171" } } }, { "category": "product_name", "name": "Oracle Java SE 6u181", "product": { "name": "Oracle Java SE 6u181", "product_id": "T012139", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:6u181" } } } ], "category": "product_name", "name": "Java SE" }, { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "F5 Enterprise Manager", "product": { "name": "F5 Enterprise Manager", "product_id": "T000125", "product_identification_helper": { "cpe": "cpe:/a:f5:enterprise_manager:-" } } } ], "category": "vendor", "name": "f5" }, { "branches": [ { "category": "product_name", "name": "Oracle Java SE Embedded 8u161", "product": { "name": "Oracle Java SE Embedded 8u161", "product_id": "T002043", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se_embedded:7.0:update_40" } } }, { "category": "product_name", "name": "Oracle JRockit R28.3.17", "product": { "name": "Oracle JRockit R28.3.17", "product_id": "T012140", "product_identification_helper": { "cpe": "cpe:/a:oracle:jrockit:r28.3.17" } } } ], "category": "vendor", "name": "oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-2783", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2783" }, { "cve": "CVE-2018-2790", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2790" }, { "cve": "CVE-2018-2794", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2794" }, { "cve": "CVE-2018-2795", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2795" }, { "cve": "CVE-2018-2796", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2796" }, { "cve": "CVE-2018-2797", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2797" }, { "cve": "CVE-2018-2798", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2798" }, { "cve": "CVE-2018-2799", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2799" }, { "cve": "CVE-2018-2800", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2800" }, { "cve": "CVE-2018-2811", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2811" }, { "cve": "CVE-2018-2814", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2814" }, { "cve": "CVE-2018-2815", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2815" }, { "cve": "CVE-2018-2825", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2825" }, { "cve": "CVE-2018-2826", "notes": [ { "category": "description", "text": "In Oracle Java SE, Oracle Java SE Embedded und Oracle JRockit existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung bzw. keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T011621", "T012139", "67646", "T011623", "T012137", "T012138", "T012136", "T004914", "T001663", "T009960", "T011994", "T012225", "T004667", "T012223", "318532", "T012224", "T009959", "T012140", "T027827", "T027828", "2951", "T002207", "T000125", "1727", "T002043" ] }, "release_date": "2018-04-17T22:00:00Z", "title": "CVE-2018-2826" } ] }
var-201804-1619
Vulnerability from variot
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Oracle Java SE Is Install There are vulnerabilities that affect confidentiality, integrity, and availability due to incomplete handling.Information is obtained by local users, information is altered, and service operation is interrupted. (DoS) An attack may be carried out. This issue affects the 'Install' component. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201903-14
https://security.gentoo.org/
Severity: Normal Title: Oracle JDK/JRE: Multiple vulnerabilities Date: March 14, 2019 Bugs: #653560, #661456, #676134 ID: 201903-14
Synopsis
Multiple vulnerabilities have been found in Oracleas JDK and JRE software suites.
Background
Java Platform, Standard Edition (Java SE) lets you develop and deploy Java applications on desktops and servers, as well as in todayas demanding embedded environments. Java offers the rich user interface, performance, versatility, portability, and security that todayas applications require.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-java/oracle-jdk-bin < 1.8.0.202 >= 1.8.0.202 2 dev-java/oracle-jre-bin < 1.8.0.202 >= 1.8.0.202 ------------------------------------------------------------------- 2 affected packages
Description
Multiple vulnerabilities have been discovered in Oracleas JDK and JRE software suites. Please review the CVE identifiers referenced below for details.
Impact
A remote attacker could possibly execute arbitrary code with the privileges of the process, gain access to information, or cause a Denial of Service condition.
Workaround
There is no known workaround at this time.
Resolution
All Oracle JDK bin users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=dev-java/oracle-jdk-bin-1.8.0.202"
All Oracle JRE bin users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=dev-java/oracle-jre-bin-1.8.0.202"
References
[ 1 ] CVE-2018-2790 https://nvd.nist.gov/vuln/detail/CVE-2018-2790 [ 2 ] CVE-2018-2794 https://nvd.nist.gov/vuln/detail/CVE-2018-2794 [ 3 ] CVE-2018-2795 https://nvd.nist.gov/vuln/detail/CVE-2018-2795 [ 4 ] CVE-2018-2796 https://nvd.nist.gov/vuln/detail/CVE-2018-2796 [ 5 ] CVE-2018-2797 https://nvd.nist.gov/vuln/detail/CVE-2018-2797 [ 6 ] CVE-2018-2798 https://nvd.nist.gov/vuln/detail/CVE-2018-2798 [ 7 ] CVE-2018-2799 https://nvd.nist.gov/vuln/detail/CVE-2018-2799 [ 8 ] CVE-2018-2800 https://nvd.nist.gov/vuln/detail/CVE-2018-2800 [ 9 ] CVE-2018-2811 https://nvd.nist.gov/vuln/detail/CVE-2018-2811 [ 10 ] CVE-2018-2814 https://nvd.nist.gov/vuln/detail/CVE-2018-2814 [ 11 ] CVE-2018-2815 https://nvd.nist.gov/vuln/detail/CVE-2018-2815 [ 12 ] CVE-2019-2422 https://nvd.nist.gov/vuln/detail/CVE-2019-2422 [ 13 ] CVE-2019-2426 https://nvd.nist.gov/vuln/detail/CVE-2019-2426
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/201903-14
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2019 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201804-1619", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "enterprise linux workstation", "scope": "eq", "trust": 1.6, "vendor": "redhat", "version": "7.0" }, { "model": "enterprise linux workstation", "scope": "eq", "trust": 1.6, "vendor": "redhat", "version": "6.0" }, { "model": "enterprise linux server", "scope": "eq", "trust": 1.6, "vendor": "redhat", "version": "7.0" }, { "model": "enterprise linux server", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "6.0" }, { "model": "jdk", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "1.10.0" }, { "model": "jre", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "1.10.0" }, { "model": "jdk", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "1.8.0" }, { "model": "struxureware data center expert", "scope": "lt", "trust": 1.0, "vendor": "schneider electric", "version": "7.6.0" }, { "model": "jre", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "1.8.0" }, { "model": "jre update", "scope": "eq", "trust": 0.9, "vendor": "oracle", "version": "1.8162" }, { "model": "jre", "scope": "eq", "trust": 0.9, "vendor": "oracle", "version": "10.0.1" }, { "model": "jdk update", "scope": "eq", "trust": 0.9, "vendor": "oracle", "version": "1.8162" }, { "model": "jdk", "scope": "eq", "trust": 0.9, "vendor": "oracle", "version": "10.0.1" }, { "model": "jdk", "scope": "eq", "trust": 0.8, "vendor": "oracle", "version": "10" }, { "model": "jdk", "scope": "eq", "trust": 0.8, "vendor": "oracle", "version": "8 update 162" }, { "model": "jre", "scope": "eq", "trust": 0.8, "vendor": "oracle", "version": "10" }, { "model": "jre", "scope": "eq", "trust": 0.8, "vendor": "oracle", "version": "8 update 162" }, { "model": "enterprise linux server", "scope": null, "trust": 0.8, "vendor": "red hat", "version": null }, { "model": "enterprise linux workstation", "scope": null, "trust": 0.8, "vendor": "red hat", "version": null } ], "sources": [ { "db": "NVD", "id": "CVE-2018-2811" }, { "db": "CNNVD", "id": "CNNVD-201804-1210" }, { "db": "JVNDB", "id": "JVNDB-2018-002871" }, { "db": "BID", "id": "103810" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:oracle:jre:1.10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jre:1.8.0:update_162:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jdk:1.10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jdk:1.8.0:update162:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:schneider-electric:struxureware_data_center_expert:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "7.6.0", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2018-2811" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Gentoo", "sources": [ { "db": "CNNVD", "id": "CNNVD-201804-1210" }, { "db": "PACKETSTORM", "id": "152088" } ], "trust": 0.7 }, "cve": "CVE-2018-2811", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/severity#" }, "@id": "https://www.variotdbs.pl/ref/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "NONE", "author": "NVD", "availabilityImpact": "PARTIAL", "baseScore": 3.7, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 1.9, "id": "CVE-2018-2811", "impactScore": 6.4, "integrityImpact": "PARTIAL", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "trust": 1.8, "userInteractionRequired": true, "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "HIGH", "attackVector": "LOCAL", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.0, "id": "CVE-2018-2811", "impactScore": 6.0, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "trust": 1.8, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2018-2811", "trust": 1.8, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-201804-1210", "trust": 0.6, "value": "HIGH" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2018-2811" }, { "db": "CNNVD", "id": "CNNVD-201804-1210" }, { "db": "JVNDB", "id": "JVNDB-2018-002871" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Oracle Java SE Is Install There are vulnerabilities that affect confidentiality, integrity, and availability due to incomplete handling.Information is obtained by local users, information is altered, and service operation is interrupted. (DoS) An attack may be carried out. \nThis issue affects the \u0027Install\u0027 component. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201903-14\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: Oracle JDK/JRE: Multiple vulnerabilities\n Date: March 14, 2019\n Bugs: #653560, #661456, #676134\n ID: 201903-14\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Oracleas JDK and JRE\nsoftware suites. \n\nBackground\n==========\n\nJava Platform, Standard Edition (Java SE) lets you develop and deploy\nJava applications on desktops and servers, as well as in todayas\ndemanding embedded environments. Java offers the rich user interface,\nperformance, versatility, portability, and security that todayas\napplications require. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 dev-java/oracle-jdk-bin \u003c 1.8.0.202 \u003e= 1.8.0.202 \n 2 dev-java/oracle-jre-bin \u003c 1.8.0.202 \u003e= 1.8.0.202 \n -------------------------------------------------------------------\n 2 affected packages\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Oracleas JDK and JRE\nsoftware suites. Please review the CVE identifiers referenced below for\ndetails. \n\nImpact\n======\n\nA remote attacker could possibly execute arbitrary code with the\nprivileges of the process, gain access to information, or cause a\nDenial of Service condition. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Oracle JDK bin users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot -v \"\u003e=dev-java/oracle-jdk-bin-1.8.0.202\"\n\nAll Oracle JRE bin users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot -v \"\u003e=dev-java/oracle-jre-bin-1.8.0.202\"\n\nReferences\n==========\n\n[ 1 ] CVE-2018-2790\n https://nvd.nist.gov/vuln/detail/CVE-2018-2790\n[ 2 ] CVE-2018-2794\n https://nvd.nist.gov/vuln/detail/CVE-2018-2794\n[ 3 ] CVE-2018-2795\n https://nvd.nist.gov/vuln/detail/CVE-2018-2795\n[ 4 ] CVE-2018-2796\n https://nvd.nist.gov/vuln/detail/CVE-2018-2796\n[ 5 ] CVE-2018-2797\n https://nvd.nist.gov/vuln/detail/CVE-2018-2797\n[ 6 ] CVE-2018-2798\n https://nvd.nist.gov/vuln/detail/CVE-2018-2798\n[ 7 ] CVE-2018-2799\n https://nvd.nist.gov/vuln/detail/CVE-2018-2799\n[ 8 ] CVE-2018-2800\n https://nvd.nist.gov/vuln/detail/CVE-2018-2800\n[ 9 ] CVE-2018-2811\n https://nvd.nist.gov/vuln/detail/CVE-2018-2811\n[ 10 ] CVE-2018-2814\n https://nvd.nist.gov/vuln/detail/CVE-2018-2814\n[ 11 ] CVE-2018-2815\n https://nvd.nist.gov/vuln/detail/CVE-2018-2815\n[ 12 ] CVE-2019-2422\n https://nvd.nist.gov/vuln/detail/CVE-2019-2422\n[ 13 ] CVE-2019-2426\n https://nvd.nist.gov/vuln/detail/CVE-2019-2426\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201903-14\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2019 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n", "sources": [ { "db": "NVD", "id": "CVE-2018-2811" }, { "db": "JVNDB", "id": "JVNDB-2018-002871" }, { "db": "BID", "id": "103810" }, { "db": "PACKETSTORM", "id": "152088" } ], "trust": 1.98 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2018-2811", "trust": 2.8 }, { "db": "BID", "id": "103810", "trust": 1.9 }, { "db": "SECTRACK", "id": "1040697", "trust": 1.6 }, { "db": "JVNDB", "id": "JVNDB-2018-002871", "trust": 0.8 }, { "db": "PACKETSTORM", "id": "152088", "trust": 0.7 }, { "db": "CNNVD", "id": "CNNVD-201804-1210", "trust": 0.6 } ], "sources": [ { "db": "NVD", "id": "CVE-2018-2811" }, { "db": "CNNVD", "id": "CNNVD-201804-1210" }, { "db": "JVNDB", "id": "JVNDB-2018-002871" }, { "db": "BID", "id": "103810" }, { "db": "PACKETSTORM", "id": "152088" } ] }, "id": "VAR-201804-1619", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.1196509 }, "last_update_date": "2021-12-19T00:57:05.378000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Oracle Critical Patch Update Advisory - April 2018", "trust": 0.8, "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html" }, { "title": "Text Form of Oracle Critical Patch Update - April 2018 Risk Matrices", "trust": 0.8, "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018verbose-3678108.html" }, { "title": "RHSA-2018:1204", "trust": 0.8, "url": "https://access.redhat.com/errata/rhsa-2018:1204" }, { "title": "RHSA-2018:1202", "trust": 0.8, "url": "https://access.redhat.com/errata/rhsa-2018:1202" }, { "title": "Oracle Corporation Java\u30d7\u30e9\u30b0\u30a4\u30f3\u306e\u8106\u5f31\u6027\u306b\u95a2\u3059\u308b\u304a\u77e5\u3089\u305b", "trust": 0.8, "url": "http://www.fmworld.net/biz/common/oracle/20180418.html" }, { "title": "Oracle Java SE Fixes for component security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=79528" } ], "sources": [ { "db": "CNNVD", "id": "CNNVD-201804-1210" }, { "db": "JVNDB", "id": "JVNDB-2018-002871" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "NVD-CWE-noinfo", "trust": 1.0 }, { "problemtype": "CWE-284", "trust": 0.8 } ], "sources": [ { "db": "NVD", "id": "CVE-2018-2811" }, { "db": "JVNDB", "id": "JVNDB-2018-002871" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.2, "url": "http://www.securityfocus.com/bid/103810" }, { "trust": 1.9, "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html" }, { "trust": 1.7, "url": "https://security.gentoo.org/glsa/201903-14" }, { "trust": 1.6, "url": "http://www.securitytracker.com/id/1040697" }, { "trust": 1.6, "url": "https://security.netapp.com/advisory/ntap-20180419-0001/" }, { "trust": 1.6, "url": "https://access.redhat.com/errata/rhsa-2018:1204" }, { "trust": 1.6, "url": "https://access.redhat.com/errata/rhsa-2018:1202" }, { "trust": 1.6, "url": "https://help.ecostruxureit.com/display/public/uadce725/security+fixes+in+struxureware+data+center+expert+v7.6.0" }, { "trust": 0.9, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2811" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-2811" }, { "trust": 0.8, "url": "https://www.ipa.go.jp/security/ciadr/vul/20180418-jre.html" }, { "trust": 0.8, "url": "http://www.jpcert.or.jp/at/2018/at180018.html" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/152088/gentoo-linux-security-advisory-201903-14.html" }, { "trust": 0.3, "url": "http://www.oracle.com/index.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2798" }, { "trust": 0.1, "url": "https://bugs.gentoo.org." }, { "trust": 0.1, "url": "https://security.gentoo.org/" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2796" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2794" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2795" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2814" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2790" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2815" }, { "trust": 0.1, "url": "https://creativecommons.org/licenses/by-sa/2.5" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2797" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-2426" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2800" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2799" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-2422" } ], "sources": [ { "db": "NVD", "id": "CVE-2018-2811" }, { "db": "CNNVD", "id": "CNNVD-201804-1210" }, { "db": "JVNDB", "id": "JVNDB-2018-002871" }, { "db": "BID", "id": "103810" }, { "db": "PACKETSTORM", "id": "152088" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "NVD", "id": "CVE-2018-2811" }, { "db": "CNNVD", "id": "CNNVD-201804-1210" }, { "db": "JVNDB", "id": "JVNDB-2018-002871" }, { "db": "BID", "id": "103810" }, { "db": "PACKETSTORM", "id": "152088" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2018-04-19T02:29:00", "db": "NVD", "id": "CVE-2018-2811" }, { "date": "2018-04-20T00:00:00", "db": "CNNVD", "id": "CNNVD-201804-1210" }, { "date": "2018-05-07T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-002871" }, { "date": "2018-04-17T00:00:00", "db": "BID", "id": "103810" }, { "date": "2019-03-14T16:24:13", "db": "PACKETSTORM", "id": "152088" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-09-08T12:29:00", "db": "NVD", "id": "CVE-2018-2811" }, { "date": "2019-10-23T00:00:00", "db": "CNNVD", "id": "CNNVD-201804-1210" }, { "date": "2018-05-07T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-002871" }, { "date": "2018-04-17T00:00:00", "db": "BID", "id": "103810" }, { "date": null, "db": "PACKETSTORM", "id": "152088" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "CNNVD", "id": "CNNVD-201804-1210" }, { "db": "BID", "id": "103810" } ], "trust": 0.9 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Oracle Java SE In Install Vulnerabilities", "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-002871" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "access control error", "sources": [ { "db": "CNNVD", "id": "CNNVD-201804-1210" } ], "trust": 0.6 } }
gsd-2018-2811
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2018-2811", "description": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", "id": "GSD-2018-2811", "references": [ "https://www.suse.com/security/cve/CVE-2018-2811.html", "https://access.redhat.com/errata/RHSA-2018:1204", "https://access.redhat.com/errata/RHSA-2018:1202" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2018-2811" ], "details": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", "id": "GSD-2018-2811", "modified": "2023-12-13T01:22:31.996799Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2018-2811", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Java", "version": { "version_data": [ { "version_affected": "=", "version_value": "Java SE: 8u162" }, { "version_affected": "=", "version_value": "10" } ] } } ] }, "vendor_name": "Oracle Corporation" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE." } ] } ] }, "references": { "reference_data": [ { "name": "GLSA-201903-14", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201903-14" }, { "name": "1040697", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1040697" }, { "name": "https://security.netapp.com/advisory/ntap-20180419-0001/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20180419-0001/" }, { "name": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0", "refsource": "CONFIRM", "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0" }, { "name": "RHSA-2018:1204", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:1204" }, { "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html" }, { "name": "RHSA-2018:1202", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:1202" }, { "name": "103810", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103810" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:oracle:jdk:1.8.0:update162:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jre:1.8.0:update162:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jdk:10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jre:10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:schneider-electric:struxureware_data_center_expert:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "7.6.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2018-2811" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ] } ] }, "references": { "reference_data": [ { "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html", "refsource": "CONFIRM", "tags": [ "Patch", "Vendor Advisory" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html" }, { "name": "1040697", "refsource": "SECTRACK", "tags": [ "Broken Link", "Third Party Advisory", "VDB Entry" ], "url": "http://www.securitytracker.com/id/1040697" }, { "name": "103810", "refsource": "BID", "tags": [ "Broken Link", "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/103810" }, { "name": "https://security.netapp.com/advisory/ntap-20180419-0001/", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://security.netapp.com/advisory/ntap-20180419-0001/" }, { "name": "RHSA-2018:1204", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2018:1204" }, { "name": "RHSA-2018:1202", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2018:1202" }, { "name": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0" }, { "name": "GLSA-201903-14", "refsource": "GENTOO", "tags": [ "Third Party Advisory" ], "url": "https://security.gentoo.org/glsa/201903-14" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 1.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.0, "impactScore": 6.0 } }, "lastModifiedDate": "2023-11-22T19:40Z", "publishedDate": "2018-04-19T02:29Z" } } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.