CVE-2018-2942: High severity oracle java se 7 vulnerability

Published Jul 18, 2018

Updated

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL). Supported versions that are affected are Java SE: 7u181 and 8u172. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Affected Software

19 affected components

Oracle JDK=1.7.0-update181

Oracle JDK=1.8.0-update172

Oracle JRE=1.7.0-update181

Oracle JRE=1.8.0-update172

NetApp Active Iq Unified Manager Vmware Vsphere

NetApp Active Iq Unified Manager Windows

NetApp Cloud Backup

NetApp E-Series SANtricity OS Controller>=11.0<=11.70.1

NetApp E-series Santricity Storage Manager

NetApp OnCommand Insight

NetApp OnCommand Unified Manager

NetApp OnCommand Workflow Automation

NetApp Plug-in For Symantec Netbackup

NetApp Snapmanager Oracle

NetApp Snapmanager Sap

NetApp Steelstore Cloud Integrated Storage

NetApp Storage Replication Adapter For Clustered Data Ontap Vmware Vsphere>=9.7

NetApp Vasa Provider For Clustered Data Ontap>=9.7

NetApp Virtual Storage Console Vmware Vsphere>=9.7

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Event History

Jul 18, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2942?

The severity of CVE-2018-2942 is high.

How does CVE-2018-2942 affect Java SE?

CVE-2018-2942 affects Java SE versions 7u181 and 8u172.

Is CVE-2018-2942 difficult to exploit?

Yes, CVE-2018-2942 is difficult to exploit.

What can an unauthenticated attacker do with CVE-2018-2942?

An unauthenticated attacker with network access can compromise Java SE using CVE-2018-2942.

Where can I find more information about CVE-2018-2942?

You can find more information about CVE-2018-2942 on Oracle's website and security advisory.