CVE-2018-3169
First published: Mon Oct 15 2018(Updated: )
It was discovered that the Hotspot component of OpenJDK did not perform access checks correctly in certain cases when performing field link resolution. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/openjdk-11 | 11.0.24+8-2~deb11u1 11.0.25+9-1~deb11u1 11.0.26+4-1 | |
| debian/openjdk-8 | 8u432-b06-2 | |
| Oracle Java SE 7 | =1.7.0-update191 | |
| Oracle Java SE 7 | =1.8.0-update181 | |
| Oracle Java SE 7 | =11.0.0 | |
| Oracle JRE | =1.7.0-update191 | |
| Oracle JRE | =1.8.0-update181 | |
| Oracle JRE | =11.0.0 | |
| Red Hat Satellite | =5.6 | |
| Red Hat Satellite | =5.7 | |
| Red Hat Satellite | =5.8 | |
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server EUS | =7.6 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.5 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Workstation | =6.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 | |
| Debian Linux | =8.0 | |
| Debian Linux | =9.0 | |
| Ubuntu | =14.04 | |
| Ubuntu | =16.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =18.10 | |
| HP P9000 Command View Advanced Edition Software | <8.6.3-00 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/105587
- http://www.securitytracker.com/id/1041889
- https://access.redhat.com/errata/RHSA-2018:2942
- https://access.redhat.com/errata/RHSA-2018:2943
- https://access.redhat.com/errata/RHSA-2018:3000
- https://access.redhat.com/errata/RHSA-2018:3001
- https://access.redhat.com/errata/RHSA-2018:3002
- https://access.redhat.com/errata/RHSA-2018:3003
- https://access.redhat.com/errata/RHSA-2018:3350
- https://access.redhat.com/errata/RHSA-2018:3409
- https://access.redhat.com/errata/RHSA-2018:3521
- https://access.redhat.com/errata/RHSA-2018:3533
- https://access.redhat.com/errata/RHSA-2018:3534
- https://access.redhat.com/errata/RHSA-2018:3671
- https://access.redhat.com/errata/RHSA-2018:3672
- https://access.redhat.com/errata/RHSA-2018:3779
- https://access.redhat.com/errata/RHSA-2018:3852
- https://lists.debian.org/debian-lts-announce/2018/11/msg00026.html
- https://security.gentoo.org/glsa/201908-10
- https://security.netapp.com/advisory/ntap-20181018-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us
- https://usn.ubuntu.com/3804-1/
- https://usn.ubuntu.com/3824-1/
- https://www.debian.org/security/2018/dsa-4326
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us
- https://launchpad.net/bugs/cve/CVE-2018-3169
- https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixJAVA
- http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/3af740792979
- http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/5370691ecaff
- https://bugzilla.redhat.com/show_bug.cgi?id=1639293
- https://security-tracker.debian.org/tracker/CVE-2018-3169
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3169
- https://nvd.nist.gov/vuln/detail/CVE-2018-3169
- https://ubuntu.com/security/CVE-2018-3169
Frequently Asked Questions
What is CVE-2018-3169?
CVE-2018-3169 is a vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot).
Which versions of Java SE are affected by CVE-2018-3169?
Java SE versions 7u191, 8u182, and 11 are affected by CVE-2018-3169.
How severe is CVE-2018-3169?
CVE-2018-3169 has a severity rating of 8.3 (high).
How can I fix CVE-2018-3169?
To fix CVE-2018-3169, update to the recommended versions of Java SE provided by your software vendor.
Where can I find more information about CVE-2018-3169?
You can find more information about CVE-2018-3169 in the references provided: [Link 1](https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixJAVA), [Link 2](https://access.redhat.com/errata/RHSA-2018:2942), [Link 3](https://access.redhat.com/errata/RHSA-2018:2943).
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-3169
- agent/severity
- agent/remedy
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/debian
- vendor/oracle
- canonical/oracle java se 7
- version/oracle java se 7/1.7.0-update191
- version/oracle java se 7/1.8.0-update181
- version/oracle java se 7/11.0.0
- canonical/oracle jre
- version/oracle jre/1.7.0-update191
- version/oracle jre/1.8.0-update181
- version/oracle jre/11.0.0
- vendor/redhat
- canonical/red hat satellite
- version/red hat satellite/5.6
- version/red hat satellite/5.7
- version/red hat satellite/5.8
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server eus
- version/red hat enterprise linux server eus/7.6
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/7.6
- version/red hat enterprise linux server/7.5
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0
- version/red hat enterprise linux workstation/7.0
- vendor/debian
- canonical/debian linux
- version/debian linux/8.0
- version/debian linux/9.0
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/14.04
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/18.10
- vendor/hp
- canonical/hp p9000 command view advanced edition software