CVE-2018-2799

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

References

https://www.debian.org/security/2018/dsa-4225

https://www.debian.org/security/2018/dsa-4185

https://usn.ubuntu.com/3691-1/

https://usn.ubuntu.com/3644-1/

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us

https://security.netapp.com/advisory/ntap-20180419-0001/

https://security.gentoo.org/glsa/201903-14

https://lists.apache.org/thread.html/r449b5d89c7b2ba3762584cf6c38e01867d4b24706e023cf2a9911307%40%3Cuser.spark.apache.org%3E

https://lists.apache.org/thread.html/b53d4601ecd9ec63c799dbe1bc5b78e0d52f4cef429da2dfe63cf06d%40%3Cfop-dev.xmlgraphics.apache.org%3E

https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3E

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0

https://access.redhat.com/errata/RHSA-2018:1975

https://access.redhat.com/errata/RHSA-2018:1974

https://access.redhat.com/errata/RHSA-2018:1724

https://access.redhat.com/errata/RHSA-2018:1723

https://access.redhat.com/errata/RHSA-2018:1722

https://access.redhat.com/errata/RHSA-2018:1721

https://access.redhat.com/errata/RHSA-2018:1278

https://access.redhat.com/errata/RHSA-2018:1270

https://access.redhat.com/errata/RHSA-2018:1206

https://access.redhat.com/errata/RHSA-2018:1204

https://access.redhat.com/errata/RHSA-2018:1202

https://access.redhat.com/errata/RHSA-2018:1201

https://access.redhat.com/errata/RHSA-2018:1191

https://access.redhat.com/errata/RHSA-2018:1188

http://www.securitytracker.com/id/1040697

http://www.securityfocus.com/bid/103872

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3