CVE-2018-2799

Name: CVE-2018-2799
Creator: NVD / NIST
Published: 2018-04-19T02:29:03.88+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.3/10EPSS 15.14%

Last modified Jun 17, 2026

CVE-2018-2799 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. EPSS estimates a 15.14% chance of exploitation in the next 30 days.

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Probability

15.14%

96.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions	Update
Oracle	Jdk	1.7.0	Update171
Oracle	Jdk	1.8.0	Update162
Oracle	Jdk	10	—
Oracle	Jre	1.7.0	Update171
Oracle	Jre	1.8.0	Update162
Oracle	Jre	10	—
Oracle	Jrockit	r28.3.17	—
Redhat	Satellite	5.6	—
Redhat	Satellite	5.7	—
Redhat	Satellite	5.8	—
Redhat	Enterprise Linux Desktop	6.0	—
Redhat	Enterprise Linux Desktop	7.0	—
Redhat	Enterprise Linux Server	6.0	—
Redhat	Enterprise Linux Server	7.0	—
Redhat	Enterprise Linux Server Aus	7.6	—
Redhat	Enterprise Linux Server Eus	7.5	—
Redhat	Enterprise Linux Server Eus	7.6	—
Redhat	Enterprise Linux Server Tus	7.6	—
Redhat	Enterprise Linux Workstation	6.0	—
Redhat	Enterprise Linux Workstation	7.0	—
Debian	Debian Linux	8.0	—
Debian	Debian Linux	9.0	—
Canonical	Ubuntu Linux	14.04	—
Canonical	Ubuntu Linux	16.04	—
Canonical	Ubuntu Linux	17.10	—
Hp	Xp7 Command View	All versions	—
Schneider-Electric	Struxureware Data Center Expert	< 7.6.0	—
Apache	Xerces-J	< 2.12.0	—

References

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/103872Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040697Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:1188Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1191Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1201Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1202Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1204Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1206Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1270Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1278Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1721Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1722Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1723Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1724Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1974Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1975Third Party Advisory
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0Third Party Advisory
https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3EIssue Tracking, Mailing List, Third Party Advisory
https://lists.apache.org/thread.html/b53d4601ecd9ec63c799dbe1bc5b78e0d52f4cef429da2dfe63cf06d%40%3Cfop-dev.xmlgraphics.apache.org%3EMailing List, Third Party Advisory
https://lists.apache.org/thread.html/r449b5d89c7b2ba3762584cf6c38e01867d4b24706e023cf2a9911307%40%3Cuser.spark.apache.org%3EMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201903-14Third Party Advisory
https://security.netapp.com/advisory/ntap-20180419-0001/Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_usThird Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_usThird Party Advisory
https://usn.ubuntu.com/3644-1/Third Party Advisory
https://usn.ubuntu.com/3691-1/Third Party Advisory
https://www.debian.org/security/2018/dsa-4185Third Party Advisory
https://www.debian.org/security/2018/dsa-4225Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/103872Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040697Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:1188Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1191Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1201Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1202Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1204Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1206Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1270Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1278Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1721Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1722Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1723Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1724Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1974Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1975Third Party Advisory
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0Third Party Advisory
https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3EIssue Tracking, Mailing List, Third Party Advisory
https://lists.apache.org/thread.html/b53d4601ecd9ec63c799dbe1bc5b78e0d52f4cef429da2dfe63cf06d%40%3Cfop-dev.xmlgraphics.apache.org%3EMailing List, Third Party Advisory
https://lists.apache.org/thread.html/r449b5d89c7b2ba3762584cf6c38e01867d4b24706e023cf2a9911307%40%3Cuser.spark.apache.org%3EMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201903-14Third Party Advisory
https://security.netapp.com/advisory/ntap-20180419-0001/Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_usThird Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_usThird Party Advisory
https://usn.ubuntu.com/3644-1/Third Party Advisory
https://usn.ubuntu.com/3691-1/Third Party Advisory
https://www.debian.org/security/2018/dsa-4185Third Party Advisory
https://www.debian.org/security/2018/dsa-4225Third Party Advisory

Timeline

Published: Apr 19, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-2799?

How severe is CVE-2018-2799?

CVE-2018-2799 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 15.14% probability of exploitation in the next 30 days.

How do I fix CVE-2018-2799?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-2799?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST