PT-2018-15803 · Oracle+4 · Jrockit+7

David Benjamin · Published 2018-01-18 · Updated 2022-10-06 · CVE-2018-2783

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Java SE versions 6u181, 7u161, and 8u152 Java SE Embedded version 8u152 JRockit version R28.3.17

Description The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, and JRockit. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all accessible data, as well as unauthorized access to critical data or complete access to all accessible data. This issue can be exploited through sandboxed Java Web Start applications, sandboxed Java applets, or by supplying data to APIs in the specified component.

Recommendations For Java SE versions 6u181, 7u161, and 8u152, update to a version that contains a fix for this issue. For Java SE Embedded version 8u152, update to a version that contains a fix for this issue. For JRockit version R28.3.17, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Security component until a patch is available. Avoid using sandboxed Java Web Start applications and sandboxed Java applets until the issue is resolved.

Fix

Related Identifiers

CVE-2018-2783

RHSA-2018:0099

RHSA-2018:0100

RHSA-2018:1203

RHSA-2018:1205

RHSA-2018:1721

RHSA-2018:1722

RHSA-2018:1723

RHSA-2018:1724

RHSA-2018:1974

RHSA-2018:1975

RHSA-2018_0099

RHSA-2018_0100

RHSA-2018_1203

RHSA-2018_1205

RHSA-2018_1721

RHSA-2018_1722

RHSA-2018_1723

RHSA-2018_1724

SUSE-SU-2018:1447-1

SUSE-SU-2018:1458-1

SUSE-SU-2018:1738-1

SUSE-SU-2018:1738-2

SUSE-SU-2018:1764-1

SUSE-SU-2018:1764-2

SUSE-SU-2018:2068-1

USN-3644-1

Affected Products

Ibm Aix

Jrockit

Java Platform

Java Se

Java Se Embedded

Red Hat

Suse

Ubuntu

References · 62

• https://cve.org/CVERecord?id=CVE-2018-2783 · Security Note
• https://ubuntu.com/security/CVE-2018-2798 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3644-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1738-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-2795 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1738-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3644-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-2794 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-2814 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1447-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-2783 · Vendor Advisory
• https://usn.ubuntu.com/3644-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1722 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1764-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2783 · Security Note