CVE-2019-2698

MEDIUM

Description

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

References

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

https://access.redhat.com/errata/RHBA-2019:0959

https://access.redhat.com/errata/RHSA-2019:1146

https://access.redhat.com/errata/RHSA-2019:1163

https://access.redhat.com/errata/RHSA-2019:1164

https://access.redhat.com/errata/RHSA-2019:1165

https://access.redhat.com/errata/RHSA-2019:1166

https://access.redhat.com/errata/RHSA-2019:1238

https://access.redhat.com/errata/RHSA-2019:1325

https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html

https://seclists.org/bugtraq/2019/May/75

https://security.gentoo.org/glsa/201908-10

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us

https://usn.ubuntu.com/3975-1/

https://www.debian.org/security/2019/dsa-4453

Details

Source: MITRE

Published: 2019-04-23

Updated: 2020-09-08

Risk Information

CVSS v2.0

Base Score: 6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3.0

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 2.2

Severity: HIGH

Tenable Plugins

View all (58 total)

IDNameProductFamilySeverity
144543Virtuozzo 6 : java-1.8.0-openjdk / java-1.8.0-openjdk-debug / etc (VZLSA-2019-0774)NessusVirtuozzo Local Security Checks
medium
129200EulerOS 2.0 SP3 : java-1.7.0-openjdk (EulerOS-SA-2019-2007)NessusHuawei Local Security Checks
medium
128285Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2019-1269)NessusAmazon Linux Local Security Checks
medium
127959GLSA-201908-10 : Oracle JDK/JRE: Multiple vulnerabilitiesNessusGentoo Local Security Checks
medium
127819Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2019-1266)NessusAmazon Linux Local Security Checks
medium
127581Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2019-1146)NessusOracle Linux Local Security Checks
medium
127435NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0157)NessusNewStart CGSL Local Security Checks
medium
127429NewStart CGSL MAIN 4.05 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0154)NessusNewStart CGSL Local Security Checks
medium
127314NewStart CGSL MAIN 4.06 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0093)NessusNewStart CGSL Local Security Checks
medium
127309NewStart CGSL MAIN 4.06 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0090)NessusNewStart CGSL Local Security Checks
medium
126924AIX Java Advisory : java_apr2019_advisory.asc (April 2019 CPU)NessusAIX Local Security Checks
medium
126872EulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2019-1745)NessusHuawei Local Security Checks
medium
126440SUSE SLED15 / SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:1211-2) (Spectre)NessusSuSE Local Security Checks
medium
126336SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1308-2)NessusSuSE Local Security Checks
medium
126167SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1644-1)NessusSuSE Local Security Checks
medium
125900Amazon Linux 2 : java-11-amazon-corretto (ALAS-2019-1228)NessusAmazon Linux Local Security Checks
medium
125756RHEL 6 : java-1.8.0-ibm (RHSA-2019:1325)NessusRed Hat Local Security Checks
medium
125698openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2019-1500)NessusSuSE Local Security Checks
medium
125676SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:1392-1)NessusSuSE Local Security Checks
medium
125608Debian DSA-4453-1 : openjdk-8 - security updateNessusDebian Local Security Checks
medium
125512EulerOS 2.0 SP3 : java-1.8.0-openjdk (EulerOS-SA-2019-1585)NessusHuawei Local Security Checks
medium
125511EulerOS 2.0 SP5 : java-1.7.0-openjdk (EulerOS-SA-2019-1584)NessusHuawei Local Security Checks
medium
125461SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2019:1345-1)NessusSuSE Local Security Checks
medium
125451openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-1439) (Spectre)NessusSuSE Local Security Checks
medium
125450openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-1438) (Spectre)NessusSuSE Local Security Checks
medium
125336SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2019:14059-1)NessusSuSE Local Security Checks
medium
125335SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1308-1)NessusSuSE Local Security Checks
medium
125288Amazon Linux 2 : java-1.7.0-openjdk (ALAS-2019-1209)NessusAmazon Linux Local Security Checks
medium
125239RHEL 8 : java-1.8.0-ibm (RHSA-2019:1238)NessusRed Hat Local Security Checks
high
125028Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : OpenJDK vulnerabilities (USN-3975-1)NessusUbuntu Local Security Checks
medium
125023SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:1219-1) (Spectre)NessusSuSE Local Security Checks
medium
125015RHEL 7 : java-1.7.1-ibm (RHSA-2019:1166)NessusRed Hat Local Security Checks
medium
125014RHEL 6 : java-1.7.1-ibm (RHSA-2019:1165)NessusRed Hat Local Security Checks
medium
125013RHEL 7 : java-1.8.0-ibm (RHSA-2019:1164)NessusRed Hat Local Security Checks
medium
125012RHEL 6 : java-1.8.0-ibm (RHSA-2019:1163)NessusRed Hat Local Security Checks
medium
124857SUSE SLED15 / SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:1211-1) (Spectre)NessusSuSE Local Security Checks
medium
124847RHEL 8 : java-1.8.0-openjdk (RHSA-2019:1146)NessusRed Hat Local Security Checks
medium
124777Debian DLA-1782-1 : openjdk-7 security updateNessusDebian Local Security Checks
medium
700660Oracle Java SE 7 < Update 221 / 8 < Update 211 / 11 < Update 3 / 12 < Update 1 Multiple Vulnerabilities (Apr 2019 CPU)Nessus Network MonitorWeb Clients
high
124397EulerOS 2.0 SP5 : java-1.8.0-openjdk (EulerOS-SA-2019-1301)NessusHuawei Local Security Checks
medium
124242CentOS 7 : java-1.7.0-openjdk (CESA-2019:0791)NessusCentOS Local Security Checks
medium
124241CentOS 6 : java-1.7.0-openjdk (CESA-2019:0790)NessusCentOS Local Security Checks
medium
124235Scientific Linux Security Update : java-1.7.0-openjdk on SL7.x x86_64 (20190422)NessusScientific Linux Local Security Checks
medium
124234Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20190422)NessusScientific Linux Local Security Checks
medium
124233RHEL 7 : java-1.7.0-openjdk (RHSA-2019:0791)NessusRed Hat Local Security Checks
medium
124232RHEL 6 : java-1.7.0-openjdk (RHSA-2019:0790)NessusRed Hat Local Security Checks
medium
124230Oracle Linux 7 : java-1.7.0-openjdk (ELSA-2019-0791)NessusOracle Linux Local Security Checks
medium
124229Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2019-0790)NessusOracle Linux Local Security Checks
medium
124202CentOS 7 : java-1.8.0-openjdk (CESA-2019:0775)NessusCentOS Local Security Checks
medium
124201CentOS 6 : java-1.8.0-openjdk (CESA-2019:0774)NessusCentOS Local Security Checks
medium
124198Oracle Java SE 1.7.0_221 / 1.8.0_211 / 1.11.0_3 / 1.12.0_1 Multiple Vulnerabilities (Apr 2019 CPU)NessusWindows
medium
124197Oracle Java SE 1.7.0_221 / 1.8.0_211 / 1.11.0_3 / 1.12.0_1 Multiple Vulnerabilities (Apr 2019 CPU) (Unix)NessusMisc.
medium
124185Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20190417)NessusScientific Linux Local Security Checks
medium
124139Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x x86_64 (20190417)NessusScientific Linux Local Security Checks
medium
124137RHEL 7 : java-1.8.0-openjdk (RHSA-2019:0775)NessusRed Hat Local Security Checks
medium
124136RHEL 6 : java-1.8.0-openjdk (RHSA-2019:0774)NessusRed Hat Local Security Checks
medium
124134Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2019-0775)NessusOracle Linux Local Security Checks
medium
124133Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2019-0774)NessusOracle Linux Local Security Checks
medium