First published: Mon Jan 15 2018(Updated: )
A use-after-free flaw was found in the way the AWT component of OpenJDK performed loading of the GTK library. An untrusted Java application or applet could use this flaw to possibly bypass certain Java sandbox restrictions.
Credit: secalert_us@oracle.com secalert_us@oracle.com secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
debian/openjdk-8 | 8u442-ga-2 | |
Oracle Java SE 7 | =1.6.0-update171 | |
Oracle Java SE 7 | =1.7.0-update161 | |
Oracle Java SE 7 | =1.8.0-update152 | |
Oracle Java SE 7 | =9.0.1 | |
Oracle JRE | =1.6.0-update171 | |
Oracle JRE | =1.7.0-update161 | |
Oracle JRE | =1.8.0-update152 | |
Oracle JRE | =9.0.1 | |
Red Hat Satellite | =5.6 | |
Red Hat Satellite | =5.7 | |
Red Hat Satellite | =5.8 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.5 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Workstation | =6.0 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
Debian Linux | =7.0 | |
Debian Linux | =8.0 | |
Debian Linux | =9.0 | |
Ubuntu | =14.04 | |
Ubuntu | =16.04 | |
Ubuntu | =17.10 | |
Schneider Electric EcoStruxure Data Center Expert | <7.6.0 | |
HP StorageWorks Command View | >=8.6.2-01 | |
HP StorageWorks Command View | >=8.6.2-01 | |
HP P9000 Command View Advanced Edition Software | >=8.6.2-01 | |
Oracle Java SE 7 | =1.9.0.1 | |
Oracle JRE | =1.9.0.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2018-2641 is high, with a severity value of 6.1.
The affected versions of Oracle Java SE are 6u171, 7u161, 8u152, and 9.0.1.
An unauthenticated attacker with network access can exploit CVE-2018-2641.
The remedy for Ubuntu openjdk-7 package is version 7.
You can find more information about CVE-2018-2641 on the Oracle website and the SecurityFocus and SecurityTracker websites.