CVE-2018-3259: Critical severity oracle database vulnerability

Published Oct 17, 2018

Updated

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Software

4 affected components

Oracle Database Server=11.2.0.4

Oracle Database Server=12.1.0.2

Oracle Database Server=12.2.0.1

Oracle Database Server=18c

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Event History

Oct 17, 2018

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-3259?

CVE-2018-3259 is classified as easily exploitable, allowing unauthenticated attackers to compromise the Java VM in affected Oracle Database versions.

How do I fix CVE-2018-3259?

To fix CVE-2018-3259, apply the latest security patch provided by Oracle for your affected database version.

Which versions of Oracle Database are affected by CVE-2018-3259?

CVE-2018-3259 affects Oracle Database versions 11.2.0.4, 12.1.0.2, 12.2.0.1, and 18c.

What kind of access is required to exploit CVE-2018-3259?

CVE-2018-3259 can be exploited by unauthenticated attackers with network access, making it highly concerning.

What components are affected by CVE-2018-3259?

CVE-2018-3259 specifically affects the Java VM component within Oracle Database Server.