CVE-2018-2938 - JDK: unspecified vulnerability fixed in 6u201, 7u191, and 8u181 (Java DB)

Back Back to CVE browser

CRITICAL

JDK: unspecified vulnerability fixed in 6u201, 7u191, and 8u181 (Java DB)

Published Jul 18, 2018

9.0

CRITICAL

CVSS 3.1

EPSS 2.07%

Description

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java DB). Supported versions that are affected are Java SE: 6u191, 7u181 and 8u172. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVE-2018-2938 addresses CVE-2018-1313. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Affected products

Vendor Oracle Corporation Product Java Default
n/a
- Version
  7u181
  Status
  affected
  Constraints
  -
- Version
  8u172
  Status
  affected
  Constraints
  -
- Version
  Java SE: 6u191
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oracle Corporation

Java

n/a

Version	Status	Constraints
7u181	affected	-
8u172	affected	-
Java SE: 6u191	affected	-

Red Hat Enterprise Linux 6

java-1.6.0-sun

Not affected
Red Hat Enterprise Linux 6

java-1.7.0-oracle

Not affected
Red Hat Enterprise Linux 6

java-1.8.0-oracle

Not affected
Red Hat Enterprise Linux 7

java-1.6.0-sun

Not affected
Red Hat Enterprise Linux 7

java-1.7.0-oracle

Not affected
Red Hat Enterprise Linux 7

java-1.8.0-oracle

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	java-1.6.0-sun	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.7.0-oracle	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.8.0-oracle	Not affected	n/a
Red Hat Enterprise Linux 7	java-1.6.0-sun	Not affected	n/a
Red Hat Enterprise Linux 7	java-1.7.0-oracle	Not affected	n/a
Red Hat Enterprise Linux 7	java-1.8.0-oracle	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (10)

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
x_refsource_CONFIRMPatchVendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html#AppendixJAVA
http://www.securityfocus.com/bid/104774
vdb-entryx_refsource_BIDBroken Link
http://www.securitytracker.com/id/1041302
vdb-entryx_refsource_SECTRACKBroken Link
https://access.redhat.com/security/cve/CVE-2018-2938
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1602141
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-14793
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-2938
https://security.netapp.com/advisory/ntap-20180726-0001/
x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-2938

Link	Providers	Tags
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html		x_refsource_CONFIRMPatchVendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html#AppendixJAVA
http://www.securityfocus.com/bid/104774		vdb-entryx_refsource_BIDBroken Link
http://www.securitytracker.com/id/1041302		vdb-entryx_refsource_SECTRACKBroken Link
https://access.redhat.com/security/cve/CVE-2018-2938		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1602141		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-14793		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-2938
https://security.netapp.com/advisory/ntap-20180726-0001/		x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-2938