Red Hat Enterprise Linux 6 Supplementary update for java-1.8.0-ibm

1) Improper input validation

EUVDB-ID: #VU28702

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2945

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Networking component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU28692

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2962

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the 2D component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper input validation

EUVDB-ID: #VU28695

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2964

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Concurrency component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper input validation

EUVDB-ID: #VU28696

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2973

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the JAXP component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper input validation

EUVDB-ID: #VU28688

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-2975

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The vulnerability exists due to improper input validation within the Scripting component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to manipulate or delete data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper input validation

EUVDB-ID: #VU28698

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2978

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Networking component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper input validation

EUVDB-ID: #VU28697

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2981

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the JAXP component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper input validation

EUVDB-ID: #VU28700

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2983

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Serialization component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper input validation

EUVDB-ID: #VU28693

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2988

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the 2D component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper input validation

EUVDB-ID: #VU28680

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-2989

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Java component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper input validation

EUVDB-ID: #VU28694

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2992

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the 2D component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper input validation

EUVDB-ID: #VU28690

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2996

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Deployment component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper input validation

EUVDB-ID: #VU28689

Risk: Medium

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-2999

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Javadoc component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improper Authorization

EUVDB-ID: #VU72551

Risk: Medium

CVSSv4.0: 6.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-17631

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks. A local user can exploit the vulnerability and escalate privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

java-1.8.0-ibm-src (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-plugin (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-jdbc (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-devel (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm-demo (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

java-1.8.0-ibm (Red Hat package): before 1.8.0.6.0-1jpp.1.el6_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2019:4113

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	14
CVE-ID	CVE-2019-2945 CVE-2019-2962 CVE-2019-2964 CVE-2019-2973 CVE-2019-2975 CVE-2019-2978 CVE-2019-2981 CVE-2019-2983 CVE-2019-2988 CVE-2019-2989 CVE-2019-2992 CVE-2019-2996 CVE-2019-2999 CVE-2019-17631
CWE-ID	CWE-125 CWE-20 CWE-285
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Red Hat Enterprise Linux for Power, big endian Operating systems & Components / Operating system Red Hat Enterprise Linux for Scientific Computing Operating systems & Components / Operating system Red Hat Enterprise Linux for IBM z Systems Operating systems & Components / Operating system Red Hat Enterprise Linux Desktop Operating systems & Components / Operating system Red Hat Enterprise Linux Workstation Operating systems & Components / Operating system Red Hat Enterprise Linux Server Operating systems & Components / Operating system java-1.8.0-ibm-src (Red Hat package) Operating systems & Components / Operating system package or component java-1.8.0-ibm-plugin (Red Hat package) Operating systems & Components / Operating system package or component java-1.8.0-ibm-jdbc (Red Hat package) Operating systems & Components / Operating system package or component java-1.8.0-ibm-devel (Red Hat package) Operating systems & Components / Operating system package or component java-1.8.0-ibm-demo (Red Hat package) Operating systems & Components / Operating system package or component java-1.8.0-ibm (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.