CVE-2018-2627: High severity oracle java se 7 vulnerability

Published Jan 17, 2018

Updated

Oracle Java SE 8u161 and 9.0.4 fixes an unspecified vulnerability in the Installer component (CVE-2018-2627). Upstream has CVSS scored this issue as: 7.5/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

External Reference:

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixJAVA

Other sources

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer). Supported versions that are affected are Java SE: 8u152 and 9.0.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to the Windows installer only. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).

Affected Software

29 affected components

Oracle JDK=1.8.0-update152

Oracle JDK=1.9.0.1

Oracle JRE=1.8.0-update152

Oracle JRE=1.9.0.1

redhat Satellite=5.8

NetApp Active Iq Unified Manager Windows>=7.3

NetApp Active Iq Unified Manager Vmware Vsphere>=9.5

NetApp Cloud Backup

NetApp E-series Santricity Management Plug-ins

NetApp E-Series SANtricity OS Controller>=11.0<=11.70.1

NetApp E-series Santricity Storage Manager

NetApp E-series Santricity Web Services Web Services Proxy

NetApp OnCommand Insight

NetApp Oncommand Shift

NetApp Oncommand Unified Manager 7-mode

NetApp OnCommand Workflow Automation

NetApp Plug-in For Symantec Netbackup

NetApp Santricity Cloud Connector

NetApp Snapmanager Oracle

NetApp Snapmanager Sap

NetApp Storage Replication Adapter For Clustered Data Ontap Vmware Vsphere>=7.2

NetApp Storage Replication Adapter For Clustered Data Ontap Windows>=7.2

NetApp Storagegrid<=9.0.4

NetApp Vasa Provider For Clustered Data Ontap>=7.2

NetApp Vasa Provider For Clustered Data Ontap=6.0

NetApp Virtual Storage Console Vmware Vsphere>=7.2

NetApp Virtual Storage Console=6.0

Oracle JDK=9.0.1

Oracle JRE=9.0.1

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 17, 2018

Data Sourced

via Red Hat·08:24 AM

DescriptionSeverityAffected Software

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is CVE-2018-2627?

CVE-2018-2627 is a vulnerability in the Java SE component of Oracle Java SE, specifically in the Installer subcomponent.

Which versions of Java SE are affected by CVE-2018-2627?

Java SE versions 8u152 and 9.0.1 are affected by CVE-2018-2627.

What is the severity level of CVE-2018-2627?

CVE-2018-2627 has a severity level of 7.5 (high).

How can an attacker exploit CVE-2018-2627?

An attacker with low privileges and access to the infrastructure where Java SE executes can exploit CVE-2018-2627.

Are there any references available for CVE-2018-2627?

Yes, you can find references for CVE-2018-2627 at the following links: [Oracle Security Advisory](http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html), [SecurityFocus](http://www.securityfocus.com/bid/102584), [SecurityTracker](http://www.securitytracker.com/id/1040203).