CVE-2018-3136
First published: Tue Oct 16 2018(Updated: )
It was discovered that the Security component of OpenJDK could incorrectly use unsigned manifest attribute entries when only properly signed entries were meant to be used. This could lead to bypass of protections provided by Jar signing. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/openjdk-11 | 11.0.24+8-2~deb11u1 11.0.25+9-1~deb11u1 11.0.26+4-1 | |
| debian/openjdk-8 | 8u432-b06-2 | |
| Oracle Java SE 7 | =1.6.0-update201 | |
| Oracle Java SE 7 | =1.7.0-update191 | |
| Oracle Java SE 7 | =1.8.0-update181 | |
| Oracle Java SE 7 | =1.8.0-update182 | |
| Oracle Java SE 7 | =11.0.0 | |
| Oracle JRE | =1.6.0-update201 | |
| Oracle JRE | =1.7.0-update191 | |
| Oracle JRE | =1.8.0-update181 | |
| Oracle JRE | =1.8.0-update182 | |
| Oracle JRE | =11.0.0 | |
| Red Hat Satellite | =5.6 | |
| Red Hat Satellite | =5.7 | |
| Red Hat Satellite | =5.8 | |
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server EUS | =7.6 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.5 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Workstation | =6.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 | |
| Debian Linux | =8.0 | |
| Debian Linux | =9.0 | |
| Ubuntu | =16.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =18.10 | |
| HP P9000 Command View Advanced Edition Software | <8.6.3-00 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/105601
- http://www.securitytracker.com/id/1041889
- https://access.redhat.com/errata/RHSA-2018:2942
- https://access.redhat.com/errata/RHSA-2018:2943
- https://access.redhat.com/errata/RHSA-2018:3000
- https://access.redhat.com/errata/RHSA-2018:3001
- https://access.redhat.com/errata/RHSA-2018:3002
- https://access.redhat.com/errata/RHSA-2018:3003
- https://access.redhat.com/errata/RHSA-2018:3007
- https://access.redhat.com/errata/RHSA-2018:3008
- https://access.redhat.com/errata/RHSA-2018:3350
- https://access.redhat.com/errata/RHSA-2018:3409
- https://access.redhat.com/errata/RHSA-2018:3521
- https://access.redhat.com/errata/RHSA-2018:3533
- https://access.redhat.com/errata/RHSA-2018:3534
- https://access.redhat.com/errata/RHSA-2018:3671
- https://access.redhat.com/errata/RHSA-2018:3672
- https://access.redhat.com/errata/RHSA-2018:3779
- https://access.redhat.com/errata/RHSA-2018:3852
- https://lists.debian.org/debian-lts-announce/2018/11/msg00026.html
- https://security.gentoo.org/glsa/201908-10
- https://security.netapp.com/advisory/ntap-20181018-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us
- https://usn.ubuntu.com/3804-1/
- https://usn.ubuntu.com/3824-1/
- https://www.debian.org/security/2018/dsa-4326
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us
- https://launchpad.net/bugs/cve/CVE-2018-3136
- https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixJAVA
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/9f786031deff
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/ca864c999536
- http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/65384f6a933f
- http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/5979d0004415
- https://bugzilla.redhat.com/show_bug.cgi?id=1639755
- https://security-tracker.debian.org/tracker/CVE-2018-3136
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3136
- https://nvd.nist.gov/vuln/detail/CVE-2018-3136
- https://ubuntu.com/security/CVE-2018-3136
Frequently Asked Questions
What is CVE-2018-3136?
CVE-2018-3136 is a vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security).
How does CVE-2018-3136 affect Java SE?
CVE-2018-3136 affects Java SE versions 6u201, 7u191, 8u182, and 11.
Is CVE-2018-3136 difficult to exploit?
Yes, CVE-2018-3136 is a difficult to exploit vulnerability.
Which systems are affected by CVE-2018-3136?
Systems running Oracle Java JDK/JRE versions 1.6.0-update201, 1.7.0-update191, 1.8.0-update181, 1.8.0-update182, and 11.0.0 are affected by CVE-2018-3136.
Where can I find more information about CVE-2018-3136?
You can find more information about CVE-2018-3136 at the following references: [Oracle's Security Advisory](https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixJAVA), [RedHat's Errata RHSA-2018:2942](https://access.redhat.com/errata/RHSA-2018:2942), [RedHat's Errata RHSA-2018:2943](https://access.redhat.com/errata/RHSA-2018:2943).
- agent/type
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-3136
- agent/severity
- agent/remedy
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/debian
- vendor/oracle
- canonical/oracle java se 7
- version/oracle java se 7/1.6.0-update201
- version/oracle java se 7/1.7.0-update191
- version/oracle java se 7/1.8.0-update181
- version/oracle java se 7/1.8.0-update182
- version/oracle java se 7/11.0.0
- canonical/oracle jre
- version/oracle jre/1.6.0-update201
- version/oracle jre/1.7.0-update191
- version/oracle jre/1.8.0-update181
- version/oracle jre/1.8.0-update182
- version/oracle jre/11.0.0
- vendor/redhat
- canonical/red hat satellite
- version/red hat satellite/5.6
- version/red hat satellite/5.7
- version/red hat satellite/5.8
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server eus
- version/red hat enterprise linux server eus/7.6
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/7.6
- version/red hat enterprise linux server/7.5
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0
- version/red hat enterprise linux workstation/7.0
- vendor/debian
- canonical/debian linux
- version/debian linux/8.0
- version/debian linux/9.0
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/18.10
- vendor/hp
- canonical/hp p9000 command view advanced edition software