Description
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Oracle | Java | Java SE: 8u162, 10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 7 | java-1.8.0-oracle +5 | 1:1.8.0.171-1jpp.1.el7 | RHSA-2018:1204 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.8.0-oracle +5 | 1:1.8.0.171-1jpp.2.el6 | RHSA-2018:1202 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | openjdk-9-jre | No fix yet | — |
Advisories 3
- RHSA-2018:1202 Red Hat Security Advisory: java-1.8.0-oracle security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2018:1204 Red Hat Security Advisory: java-1.8.0-oracle security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2023-1375 Oracle Java SE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 6, 2023
References
- GLSA-201903-14 vendor-advisory
- 1040697 vdb-entry
- https://security.netapp.com/advisory/ntap-20180419-0001/
- https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
- RHSA-2018:1204 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- RHSA-2018:1202 vendor-advisory
- 103810 vdb-entry