Privilege escalation in JRockit and Oracle Java SE - CVE-2018-2794

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU11948

Privilege escalation in JRockit and Oracle Java SE - CVE-2018-2794

Published: April 19, 2018 / Updated: April 19, 2018


Vulnerability identifier: #VU11948
CSH Severity: Low
CVSS v4: 7.5 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-2794
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists in the Java SE, JRockit component of Oracle Java SE due to improper security restrictions. A local attacker can execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Affected software

JRockit
Oracle Java SE
Gentoo Linux
Amazon Linux AMI
Debian Linux
IBM AIX
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux EUS Compute Node
Red Hat Satellite

IBM Cognos Command Center
openSUSE Leap

How to mitigate CVE-2018-2794

Install update from vendor's website.


External References

Related Security Bulletins