CVE-2018-2783: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are...

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u161 and 8u152; Java SE Embedded: 8u152; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Metrics

CVSS 3.1

7.4/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Probability

3.97%

89.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions	Update
Oracle	Jdk	1.6.0	Update181
Oracle	Jdk	1.7.0	Update161
Oracle	Jdk	1.8.0	Update152
Oracle	Jre	1.6.0	Update181
Oracle	Jre	1.7.0	Update161
Oracle	Jre	1.8.0	Update152
Oracle	Jrockit	r28.3.17	—
Redhat	Satellite	5.6	—
Redhat	Satellite	5.7	—
Redhat	Satellite	5.8	—
Redhat	Enterprise Linux Desktop	6.0	—
Redhat	Enterprise Linux Desktop	7.0	—
Redhat	Enterprise Linux Server	6.0	—
Redhat	Enterprise Linux Server	7.0	—
Redhat	Enterprise Linux Workstation	6.0	—
Redhat	Enterprise Linux Workstation	7.0	—
Canonical	Ubuntu Linux	16.04	—
Canonical	Ubuntu Linux	17.10	—
Hp	Xp7 Command View	All versions	—

References

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/103832Broken Link
http://www.securitytracker.com/id/1040697Broken Link
https://access.redhat.com/errata/RHSA-2018:1203Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1205Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1721Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1722Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1723Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1724Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1974Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1975Third Party Advisory
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0Third Party Advisory
https://security.netapp.com/advisory/ntap-20180419-0001/Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_usThird Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_usThird Party Advisory
https://usn.ubuntu.com/3644-1/Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/103832Broken Link
http://www.securitytracker.com/id/1040697Broken Link
https://access.redhat.com/errata/RHSA-2018:1203Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1205Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1721Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1722Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1723Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1724Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1974Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1975Third Party Advisory
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0Third Party Advisory
https://security.netapp.com/advisory/ntap-20180419-0001/Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_usThird Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_usThird Party Advisory
https://usn.ubuntu.com/3644-1/Third Party Advisory

Timeline

Published: Apr 19, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-2783?

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u161 and 8u152; Java SE Embedded: 8u152; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

How severe is CVE-2018-2783?

CVE-2018-2783 has a CVSS score of 7.4/10 (HIGH severity). The EPSS model estimates a 3.97% probability of exploitation in the next 30 days.

How do I fix CVE-2018-2783?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.