Skip to content

Vulnerability in the Java SE, Java SE Embedded, JRockit...

Moderate severity Unreviewed Published May 13, 2022 to the GitHub Advisory Database • Updated Jan 27, 2023

Package

No package listedSuggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171; JRockit: R28.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

References

Published by the National Vulnerability Database Jul 18, 2018
Published to the GitHub Advisory Database May 13, 2022
Last updated Jan 27, 2023

Severity

Moderate

Weaknesses

No CWEs

CVE ID

CVE-2018-2952

GHSA ID

GHSA-pvp8-49wp-gw4c

Source code

No known source code

Dependabot alerts are not supported on this advisory because it does not have a package from a supported ecosystem with an affected and fixed version.

Learn more about GitHub language support

Checking history
See something to contribute? Suggest improvements for this vulnerability.