KLA11340 Multiple vulnerabilities in Oracle Java SE

Multiple serious vulnerabilities were found in Oracle Java SE. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, cause denial of service, bypass security restrictions.

Below is a complete list of vulnerabilities:

1. An unspecified vulnerability in Scripting component can be exploited remotely to execute arbitrary code;
2. An unspecified vulnerability in JavaFX component can be exploited remotely to execute arbitrary code;
3. An unspecified vulnerability in Hotspot component can be exploited remotely to execute arbitrary code;
4. An unspecified vulnerability in JNDI component can be exploited locally to execute arbitrary code;
5. An unspecified vulnerability in Serviceability component can be exploited remotely to obtain sensitive information;
6. An unspecified vulnerability in JSSE component can be exploited remotely to obtain sensitive information;
7. An unspecified vulnerability in Sound component can be exploited remotely to cause denial of service;
8. An unspecified vulnerability in Sound component can be exploited remotely to obtain sensitive information;
9. An unspecified vulnerability in Utility component can be exploited remotely to bypass security restrictions;
10. An unspecified vulnerability in libpng can be exploited remotely to cause denial of service;
11. An unspecified vulnerability in Security component can be exploited remotely to bypass security restrictions;
12. An unspecified vulnerability in Networking component can be exploited remotely to bypass security restrictions;

Original advisories

[https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixJAVA](Oracle Critical Patch Update Advisory - October 2018)

Related products

Oracle-Java-JRE-1.8.x

Oracle-JRockit

CVE list

CVE-2018-3183 high

CVE-2018-3209 high

CVE-2018-3169 high

CVE-2018-3149 high

CVE-2018-3211 warning

CVE-2018-3180 high

CVE-2018-3214 warning

CVE-2018-3157 warning

CVE-2018-3150 warning

CVE-2018-13785 warning

CVE-2018-3136 warning

CVE-2018-3139 warning

Solution

Update to the latest version

Oracle software downloads

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

Affected Products

• Java SE 6u201 and earlierJava SE 7u191 and earlierJava SE 8u182 and earlierJava SE 11 and earlierJava SE Embedded 8u181 and earlierJRockit R28.3.19 and earlier