CVE-2019-2518 - Vulnerability in the Java VM component of Oracle Database Server

Back Back to CVE browser

HIGH

Vulnerability in the Java VM component of Oracle Database Server

Published Apr 23, 2019

7.5

HIGH

CVSS 3.0

EPSS 1.21%

Description

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected products

Vendor Oracle Corporation Product Oracle Database Default
n/a
- Version
  11.2.0.4
  Status
  affected
  Constraints
  -
- Version
  12.1.0.2
  Status
  affected
  Constraints
  -
- Version
  12.2.0.1
  Status
  affected
  Constraints
  -
- Version
  18c
  Status
  affected
  Constraints
  -
- Version
  19c
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oracle Corporation

Oracle Database

n/a

Version	Status	Constraints
11.2.0.4	affected	-
12.1.0.2	affected	-
12.2.0.1	affected	-
18c	affected	-
19c	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
x_refsource_MISCPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-12158
Advisory

Link	Providers	Tags
http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html		x_refsource_MISCPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-12158		Advisory