Red Hat update for Oracle Java SE

1) Security restrictions bypass

EUVDB-ID: #VU12354

Risk: Low

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1417

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists due to allowing untrusted code running under a security manager. A remote attacker can gain root privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU10125

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2579

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit Libraries component. A remote attacker can partially access data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU10126

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2581

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to a flaw in the Java SE JavaFX component. A remote attacker can partially access data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Security restrictions bypass

EUVDB-ID: #VU10127

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2582

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit Libraries component. A remote attacker can modify data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU10128

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2588

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit LDAP component. A remote attacker can partially access data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Security restrictions bypass

EUVDB-ID: #VU10129

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2599

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit JNDI component. A remote attacker can partially modify data and cause partial denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Security restrictions bypass

EUVDB-ID: #VU10130

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2602

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded I18n component. A local attacker can partially access data, partially modify data, and partially deny service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Security restrictions bypass

EUVDB-ID: #VU10131

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2603

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit Libraries component. A remote attacker can cause partial denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU10132

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2618

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit JCE component. A remote attacker can access data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Privilege escalation

EUVDB-ID: #VU10133

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2627

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges.

The weakness exists due to a flaw in the Java SE Installer. A local attacker can gain system privileges on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Security restrictions bypass

EUVDB-ID: #VU10134

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2629

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit JGSS component. A remote attacker can modify data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Privilege escalation

EUVDB-ID: #VU10135

Risk: Low

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2633

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit JNDI component. A remote attacker can gain system privileges on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Information disclosure

EUVDB-ID: #VU10136

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2634

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded JGSS component. A remote attacker can access data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Security restrictions bypass

EUVDB-ID: #VU10137

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2637

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit JMX component. A remote attacker can access and modify data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Privilege escalation

EUVDB-ID: #VU10138

Risk: Low

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2638

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to a flaw in the Java SE Deployment component. A remote attacker can gain system privileges on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Privilege escalation

EUVDB-ID: #VU10139

Risk: Low

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2639

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to a flaw in the Java SE Deployment component. A remote attacker can gain system privileges on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Security restrictions bypass

EUVDB-ID: #VU10140

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2641

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded AWT component. A remote attacker can modify data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Denial of service

EUVDB-ID: #VU10141

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2657

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to a flaw in the Java SE, JRockit Serialization component. A remote attacker can cause partial denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Denial of service

EUVDB-ID: #VU10142

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2663

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit Libraries component. A remote attacker can cause partial denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Denial of service

EUVDB-ID: #VU10144

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2677

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded AWT component. A remote attacker can cause partial denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Denial of service

EUVDB-ID: #VU10145

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2678

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit JNDI component. A remote attacker can cause partial denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Satellite: 5.8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:5.8:*:*:*:*:*:*:

External links

http://access.redhat.com/errata/RHSA-2018:1463

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.