First published: Mon Jan 15 2018(Updated: )
It was discovered that the DerValue class in the Libraries component of OpenJDK failed to sufficiently limit the amount of memory allocated when reading DER (Distinguished Encoding Rules) encoded input. It could allocate a large amount of memory even when processing short input. A remote attacker could possibly use this flaw to make a Java application use an excessive amount of memory if it parsed attacker-supplied DER encoded input.
Credit: secalert_us@oracle.com secalert_us@oracle.com secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
debian/openjdk-8 | 8u442-ga-2 | |
Oracle Java SE 7 | =1.6.0-update171 | |
Oracle Java SE 7 | =1.7.0-update161 | |
Oracle Java SE 7 | =1.8.0-update152 | |
Oracle Java SE 7 | =9.0.1 | |
Oracle JRE | =1.6.0-update171 | |
Oracle JRE | =1.7.0-update161 | |
Oracle JRE | =1.8.0-update152 | |
Oracle JRE | =9.0.1 | |
Oracle Java SE | =r28.3.16 | |
Red Hat Satellite | =5.6 | |
Red Hat Satellite | =5.7 | |
Red Hat Satellite | =5.8 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.5 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Workstation | =6.0 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
Debian Linux | =7.0 | |
Debian Linux | =8.0 | |
Debian Linux | =9.0 | |
Ubuntu | =14.04 | |
Ubuntu | =16.04 | |
Ubuntu | =17.10 | |
Schneider Electric EcoStruxure Data Center Expert | <7.6.0 | |
HP StorageWorks Command View | >=8.6.2-01 | |
HP StorageWorks Command View | >=8.6.2-01 | |
HP P9000 Command View Advanced Edition Software | >=8.6.2-01 | |
Oracle Java SE 7 | =1.9.0.1 | |
Oracle JRE | =1.9.0.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2018-2603 is a vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries).
The affected versions of Java SE are 6u171, 7u161, 8u152, and 9.0.1.
An unauthenticated attacker can easily exploit CVE-2018-2603.
The severity of CVE-2018-2603 is medium, with a severity value of 5.3.
You can find more information about CVE-2018-2603 on the MITRE CVE website.