CVE-2018-2796 Information

Description

Vulnerability in the Java SE Java SE Embedded JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 7u171 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE Java SE Embedded JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE Java SE Embedded JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Reference

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html http://www.securityfocus.com/bid/103868 http://www.securitytracker.com/id/1040697 https://access.redhat.com/errata/RHSA-2018:1188 https://access.redhat.com/errata/RHSA-2018:1191 https://access.redhat.com/errata/RHSA-2018:1201 https://access.redhat.com/errata/RHSA-2018:1202 https://access.redhat.com/errata/RHSA-2018:1204 https://access.redhat.com/errata/RHSA-2018:1206 https://access.redhat.com/errata/RHSA-2018:1270 https://access.redhat.com/errata/RHSA-2018:1278 https://access.redhat.com/errata/RHSA-2018:1721 https://access.redhat.com/errata/RHSA-2018:1722 https://access.redhat.com/errata/RHSA-2018:1723 https://access.redhat.com/errata/RHSA-2018:1724 https://access.redhat.com/errata/RHSA-2018:1974 https://access.redhat.com/errata/RHSA-2018:1975 https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 https://security.gentoo.org/glsa/201903-14 https://security.netapp.com/advisory/ntap-20180419-0001/ https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us https://usn.ubuntu.com/3644-1/ https://usn.ubuntu.com/3691-1/ https://www.debian.org/security/2018/dsa-4185 https://www.debian.org/security/2018/dsa-4225

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

LOW

Base Severity

5.3