CVE-2018-3259
Summary
| CVE | CVE-2018-3259 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-10-17 01:31:00 UTC |
| Updated | 2019-10-03 00:03:00 UTC |
| Description | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Oracle | Database Server | 11.2.0.4 | All | All | All |
| Application | Oracle | Database Server | 12.1.0.2 | All | All | All |
| Application | Oracle | Database Server | 12.2.0.1 | All | All | All |
| Application | Oracle | Database Server | 18c | All | All | All |
| Application | Oracle | Database Server | 11.2.0.4 | All | All | All |
| Application | Oracle | Database Server | 12.1.0.2 | All | All | All |
| Application | Oracle | Database Server | 12.2.0.1 | All | All | All |
| Application | Oracle | Database Server | 18c | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Oracle Database Multiple Bugs Let Remote and Local Users Deny Service and Let Remote Users Modify Data and Gain Elevated Privileges - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| Oracle Database Server Multiple Remote Security Vulnerabilities | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CPU Oct 2018 | CONFIRM | www.oracle.com | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.