CVE-2019-2426

CVE	CVE-2019-2426
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-01-16 19:30:00 UTC
Updated	2022-10-06 17:55:00 UTC
Description	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Problem Types: NVD-CWE-noinfo

Type	Vendor	Product	Version	Update	Edition	Language
Application	Hp	Xp7 Command View	All	All	All	All
Application	Netapp	Oncommand Unified Manager	All	All	All	All
Application	Netapp	Oncommand Unified Manager	All	All	All	All
Application	Netapp	Oncommand Unified Manager	All	All	All	All
Application	Netapp	Oncommand Unified Manager	All	All	All	All
Application	Netapp	Oncommand Unified Manager	All	All	All	All
Application	Netapp	Oncommand Unified Manager	All	All	All	All
Application	Netapp	Oncommand Workflow Automation	All	All	All	All
Application	Netapp	Oncommand Workflow Automation	All	All	All	All
Application	Netapp	Snapmanager	-	All	All	All
Application	Netapp	Snapmanager	-	All	All	All
Application	Netapp	Snapmanager	-	All	All	All
Application	Netapp	Snapmanager	-	All	All	All
Operating System	Opensuse	Leap	42.3	All	All	All
Application	Oracle	Jdk	1.7.0	update201	All	All
Application	Oracle	Jdk	1.8.0	update191	All	All
Application	Oracle	Jdk	1.8.0	update192	All	All
Application	Oracle	Jdk	11.0.1	All	All	All
Application	Oracle	Jdk	1.7.0	update201	All	All
Application	Oracle	Jdk	1.8.0	update191	All	All
Application	Oracle	Jdk	1.8.0	update192	All	All
Application	Oracle	Jdk	11.0.1	All	All	All
Application	Oracle	Jre	1.7.0	update201	All	All
Application	Oracle	Jre	1.7.0	update_201	All	All
Application	Oracle	Jre	1.8.0	update191	All	All
Application	Oracle	Jre	1.8.0	update192	All	All
Application	Oracle	Jre	1.8.0	update_191	All	All
Application	Oracle	Jre	1.8.0	update_192	All	All
Application	Oracle	Jre	11.0.1	All	All	All
Application	Oracle	Jre	1.7.0	update_201	All	All
Application	Oracle	Jre	1.8.0	update_191	All	All
Application	Oracle	Jre	1.8.0	update_192	All	All
Application	Oracle	Jre	11.0.1	All	All	All

Reference	Source	Link	Tags
Oracle Java SE CVE-2019-2426 Information Disclosure Vulnerability	BID	www.securityfocus.com	Third Party Advisory, VDB Entry
January 2019 Java Platform Standard Edition Vulnerabilities in NetApp Products \| NetApp Product Security	CONFIRM	security.netapp.com	Patch, Third Party Advisory
Oracle Critical Patch Update - January 2019	CONFIRM	www.oracle.com	Patch, Vendor Advisory
Oracle JDK/JRE: Multiple vulnerabilities (GLSA 201903-14) — Gentoo security	GENTOO	security.gentoo.org	Third Party Advisory
Document Display \| HPE Support Center	CONFIRM	support.hpe.com
[security-announce] openSUSE-SU-2019:1439-1: important: Security update	SUSE	lists.opensuse.org
[security-announce] openSUSE-SU-2019:1500-1: moderate: Security update f	SUSE	lists.opensuse.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.