CVE-2018-3183
First published: Mon Oct 15 2018(Updated: )
It was discovered that the Scripting component of OpenJDK did not properly restrict access to scripting engine via Global object's engine variable when using Security Manager or class filtering. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/openjdk-8 | 8u432-b06-2 | |
| Oracle Java SE 7 | =1.8.0-update181 | |
| Oracle Java SE 7 | =11.0.0 | |
| Oracle JRE | =1.8.0-update181 | |
| Oracle JRE | =11.0.0 | |
| Oracle Java SE | =r28.3.19 | |
| Red Hat Satellite | =5.8 | |
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server EUS | =7.6 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.5 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Workstation | =6.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 | |
| Debian Linux | =9.0 | |
| Ubuntu | =16.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =18.10 | |
| HP P9000 Command View Advanced Edition Software | <8.6.3-00 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/105622
- http://www.securitytracker.com/id/1041889
- https://access.redhat.com/errata/RHSA-2018:2942
- https://access.redhat.com/errata/RHSA-2018:2943
- https://access.redhat.com/errata/RHSA-2018:3002
- https://access.redhat.com/errata/RHSA-2018:3003
- https://access.redhat.com/errata/RHSA-2018:3521
- https://access.redhat.com/errata/RHSA-2018:3533
- https://access.redhat.com/errata/RHSA-2018:3534
- https://access.redhat.com/errata/RHSA-2018:3852
- https://security.gentoo.org/glsa/201908-10
- https://security.netapp.com/advisory/ntap-20181018-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us
- https://usn.ubuntu.com/3804-1/
- https://www.debian.org/security/2018/dsa-4326
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us
- https://launchpad.net/bugs/cve/CVE-2018-3183
- https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixJAVA
- http://hg.openjdk.java.net/jdk8u/jdk8u/nashorn/rev/2152c4a01445
- http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/ba5ec2308106
- https://bugzilla.redhat.com/show_bug.cgi?id=1639268
- https://security-tracker.debian.org/tracker/CVE-2018-3183
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3183
- https://nvd.nist.gov/vuln/detail/CVE-2018-3183
- https://ubuntu.com/security/CVE-2018-3183
Frequently Asked Questions
What is CVE-2018-3183?
CVE-2018-3183 is a vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE that allows an unauthenticated attacker to exploit the system.
Which versions of Java SE, Java SE Embedded, and JRockit are affected by CVE-2018-3183?
Java SE versions 8u182 and 11, Java SE Embedded version 8u181, and JRockit version R28.3.19 are affected by CVE-2018-3183.
How severe is the vulnerability CVE-2018-3183?
CVE-2018-3183 is classified as critical with a severity value of 9.
How can I fix the vulnerability CVE-2018-3183?
To fix the vulnerability CVE-2018-3183, update your Java SE, Java SE Embedded, or JRockit to the recommended versions provided by the vendor.
Where can I find more information about CVE-2018-3183?
You can find more information about CVE-2018-3183 from the official Oracle and Red Hat security advisories.
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-3183
- agent/severity
- agent/remedy
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- agent/source
- agent/author
- agent/tags
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/debian
- vendor/oracle
- canonical/oracle java se 7
- version/oracle java se 7/1.8.0-update181
- version/oracle java se 7/11.0.0
- canonical/oracle jre
- version/oracle jre/1.8.0-update181
- version/oracle jre/11.0.0
- canonical/oracle java se
- version/oracle java se/r28.3.19
- vendor/redhat
- canonical/red hat satellite
- version/red hat satellite/5.8
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server eus
- version/red hat enterprise linux server eus/7.6
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/7.6
- version/red hat enterprise linux server/7.5
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0
- version/red hat enterprise linux workstation/7.0
- vendor/debian
- canonical/debian linux
- version/debian linux/9.0
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/18.10
- vendor/hp
- canonical/hp p9000 command view advanced edition software