Vulnerability CVE-2018-2815


Published: 2018-04-18   Modified: 2018-04-19

Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Type:

CWE-noinfo

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial
Affected software
Redhat -> Enterprise linux desktop 
Redhat -> Enterprise linux server 
Redhat -> Enterprise linux workstation 
Redhat -> Enterprise linux server aus 
Redhat -> Enterprise linux server eus 
Redhat -> Enterprise linux server tus 
Oracle -> JDK 
Oracle -> JRE 
Oracle -> Jrockit 
HP -> Xp7 command view 
Debian -> Debian linux 
Canonical -> Ubuntu linux 

 References:
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.securityfocus.com/bid/103848
http://www.securitytracker.com/id/1040697
https://access.redhat.com/errata/RHSA-2018:1188
https://access.redhat.com/errata/RHSA-2018:1191
https://access.redhat.com/errata/RHSA-2018:1201
https://access.redhat.com/errata/RHSA-2018:1202
https://access.redhat.com/errata/RHSA-2018:1203
https://access.redhat.com/errata/RHSA-2018:1204
https://access.redhat.com/errata/RHSA-2018:1205
https://access.redhat.com/errata/RHSA-2018:1206
https://access.redhat.com/errata/RHSA-2018:1270
https://access.redhat.com/errata/RHSA-2018:1278
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
https://security.gentoo.org/glsa/201903-14
https://security.netapp.com/advisory/ntap-20180419-0001/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us
https://usn.ubuntu.com/3644-1/
https://usn.ubuntu.com/3691-1/
https://www.debian.org/security/2018/dsa-4185
https://www.debian.org/security/2018/dsa-4225

Copyright 2024, cxsecurity.com

 

Back to Top