PT-2018-15674 · Oracle+1 · Java Se+2

Published 2018-01-17 · Updated 2025-05-06 · CVE-2018-2627

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Java SE versions 8u152 and 9.0.1

Description The issue is a difficult to exploit vulnerability in the Java SE component, specifically in the Installer subcomponent. It allows a low privileged attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Although the vulnerability is in Java SE, attacks may significantly impact additional products, and successful attacks can result in the takeover of Java SE. This vulnerability applies to the Windows installer only.

Recommendations For Java SE version 8u152, update to a version that fixes this issue. For Java SE version 9.0.1, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the Windows installer to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-2627

RHSA-2018:0099

RHSA-2018:1463

RHSA-2018_0099

Affected Products

Java Platform

Java Se

Red Hat

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2018-2627 · Security Note
• http://oracle.com/technetwork/security-advisory/cpujan2018-3236628.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1463 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0099 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2627 · Vendor Advisory
• https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 · Note
• https://security.netapp.com/advisory/ntap-20180117-0001 · Note
• http://securitytracker.com/id/1040203 · Note
• https://t.me/cvenotify/121000 · Telegram Post
• https://t.me/cvenotify/60981 · Telegram Post
• http://securityfocus.com/bid/102584 · Note