CVE-2018-2938: Critical severity oracle java se 7 vulnerability

Published Jul 18, 2018

Updated

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java DB). Supported versions that are affected are Java SE: 6u191, 7u181 and 8u172. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVE-2018-2938 addresses CVE-2018-1313. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Affected Software

21 affected components

Oracle JDK=1.6.0-update191

Oracle JDK=1.7.0-update181

Oracle JDK=1.8.0-update172

Oracle JRE=1.6.0-update191

Oracle JRE=1.7.0-update181

Oracle JRE=1.8.0-update172

NetApp Active Iq Unified Manager Vmware Vsphere

NetApp Active Iq Unified Manager Windows

NetApp Cloud Backup

NetApp E-Series SANtricity OS Controller>=11.0<=11.70.1

NetApp E-series Santricity Storage Manager

NetApp OnCommand Insight

NetApp OnCommand Unified Manager

NetApp OnCommand Workflow Automation

NetApp Plug-in For Symantec Netbackup

NetApp Snapmanager Oracle

NetApp Snapmanager Sap

NetApp Steelstore Cloud Integrated Storage

NetApp Storage Replication Adapter For Clustered Data Ontap Vmware Vsphere>=9.7

NetApp Vasa Provider For Clustered Data Ontap>=9.7

NetApp Virtual Storage Console Vmware Vsphere>=9.7

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Event History

Jul 18, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2938?

The severity of CVE-2018-2938 is critical.

How does CVE-2018-2938 affect Java SE?

CVE-2018-2938 affects Java SE versions 6u191, 7u181, and 8u172.

What is the impact of CVE-2018-2938?

CVE-2018-2938 allows an unauthenticated attacker with network access to compromise Java SE.

What is the recommended solution for CVE-2018-2938?

To mitigate CVE-2018-2938, update to the latest versions of Java SE 6, 7, or 8.

Where can I find more information about CVE-2018-2938?

You can find more information about CVE-2018-2938 in the Oracle security advisory and other related references.