Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

Oracle Java SE and JRockit allow remote takeover

CVE-2018-2794 · published 8 years ago
Summary

Versions of Oracle Java SE (6u181, 7u171, 8u162, 10) and JRockit (R28.3.17) can be tricked into running malicious code, giving an attacker control of the Java runtime. The flaw can be triggered through specially crafted web‑started applications, applets or data sent to Java APIs, and it requires a user to interact with the malicious content. Apply the latest security patches from Oracle or upgrade to a newer, supported Java release as soon as possible.

What to do
  • Update schneider-electric struxureware_data_center_expert to version 7.6.0 or later.
Affected software
VendorProductAffected versions
oracle jdk 1.6.0
1.7.0
1.8.0
10
cpe:2.3:a:oracle:jdk:1.6.0:update181:*:*:*:*:*:*
oracle jre 1.6.0
1.7.0
1.8.0
10
cpe:2.3:a:oracle:jre:1.6.0:update181:*:*:*:*:*:*
oracle jrockit r28.3.17
cpe:2.3:a:oracle:jrockit:r28.3.17:*:*:*:*:*:*:*
redhat satellite 5.6
5.7
5.8
cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0
7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0
7.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.6
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_eus 7.5
7.6
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.6
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0
7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
debian debian_linux 8.0
9.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
canonical ubuntu_linux 14.04
16.04
17.10
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
hp xp7_command_view All versions
cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:*
schneider-electric struxureware_data_center_expert < 7.6.0
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:*:*:*:*:*:*:*:*
Original advisory text
Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficul...
Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, JRockit executes to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.7 High
Exploitation
<1% chance of attack within 30 days
Timeline
Published19 Apr 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-2794 · NVD
Track software like this
Free during beta