Oracle Java SE/Java SE Embedded CVE-2018-3136 Remote Security Vulnerability

Bugtraq ID:	105601
Class:	Unknown
CVE:	CVE-2018-3136
Remote:	Yes
Local:	No
Published:	Oct 16 2018 12:00AM
Updated:	Dec 19 2018 11:00AM
Credit:	Oracle
Vulnerable:	Oracle JRE(Windows Production Release) 1.8 Update 182 Oracle JRE(Windows Production Release) 1.8 Update 181 Oracle JRE(Windows Production Release) 1.7 Update 191 Oracle JRE(Windows Production Release) 1.6 Update 201 Oracle JRE(Windows Production Release) 11 Oracle JRE(Solaris Production Release) 1.8 Update 182 Oracle JRE(Solaris Production Release) 1.8 Update 181 Oracle JRE(Solaris Production Release) 1.7 Update 191 Oracle JRE(Solaris Production Release) 1.6 Update 201 Oracle JRE(Solaris Production Release) 11 Oracle JRE(macOS Production Release) 1.8 Update 182 Oracle JRE(macOS Production Release) 1.8 Update 181 Oracle JRE(macOS Production Release) 1.7 Update 191 Oracle JRE(macOS Production Release) 1.6 Update 201 Oracle JRE(macOS Production Release) 11 Oracle JRE(Linux Production Release) 1.8 Update 182 Oracle JRE(Linux Production Release) 1.8 Update 181 Oracle JRE(Linux Production Release) 1.7 Update 191 Oracle JRE(Linux Production Release) 1.6 Update 201 Oracle JRE(Linux Production Release) 11 Oracle JDK(Windows Production Release) 1.8 Update 182 Oracle JDK(Windows Production Release) 1.8 Update 181 Oracle JDK(Windows Production Release) 1.7 Update 191 Oracle JDK(Windows Production Release) 1.6 Update 201 Oracle JDK(Windows Production Release) 11 Oracle JDK(Solaris Production Release) 1.8 Update 182 Oracle JDK(Solaris Production Release) 1.8 Update 181 Oracle JDK(Solaris Production Release) 1.7 Update 191 Oracle JDK(Solaris Production Release) 1.6 Update 201 Oracle JDK(Solaris Production Release) 11 Oracle JDK(macOS Production Release) 1.8 Update 182 Oracle JDK(macOS Production Release) 1.8 Update 181 Oracle JDK(macOS Production Release) 1.7 Update 191 Oracle JDK(macOS Production Release) 1.6 Update 201 Oracle JDK(macOS Production Release) 11 Oracle JDK(Linux Production Release) 1.8 Update 182 Oracle JDK(Linux Production Release) 1.8 Update 181 Oracle JDK(Linux Production Release) 1.7 Update 191 Oracle JDK(Linux Production Release) 1.6 Update 201 Oracle JDK(Linux Production Release) 11 IBM Vios 2.2.3 IBM Vios 2.2.1 4 IBM Vios 2.2 IBM Vios 2.2.4.0 IBM Vios 2.2.3.50 IBM Vios 2.2.3.4 IBM Vios 2.2.3.3 IBM Vios 2.2.3.2 IBM Vios 2.2.3.0 IBM Vios 2.2.2.6 IBM Vios 2.2.2.5 IBM Vios 2.2.2.4 IBM Vios 2.2.2.0 IBM Vios 2.2.2.0 IBM Vios 2.2.1.9 IBM Vios 2.2.1.8 IBM Vios 2.2.1.3 IBM Vios 2.2.1.1 IBM Vios 2.2.1.0 IBM Vios 2.2.0.13 IBM Vios 2.2.0.12 IBM Vios 2.2.0.11 IBM Vios 2.2.0.10 IBM Java 8.0.5.6 IBM Java 8.0.5.5 IBM Java 8.0.5.17 IBM Java 8.0.5.11 IBM Java 7.1.4.5 IBM Java 7.1.4.10 IBM Java 7.1.4.1 IBM Java 7.1.4.0 IBM Java 7.0.10.5 IBM Java 7.0.10.10 IBM Java 7.0.10.1 IBM Java 7.0.10.0 IBM Java 6.1.8.7 IBM Java 6.1.8.50 IBM Java 6.1.8.5 IBM Java 6.1.8.45 IBM Java 6.1.8.41 IBM Java 6.1.8.40 IBM Java 6.1.8.4 IBM Java 6.1.8.35 IBM Java 6.1.8.3 IBM Java 6.1.8.20 IBM Java 6.1.8.2 IBM Java 6.1.8.15 IBM Java 6.1.8.0 IBM Java 6.0.16.21 IBM Java 6.0.16.20 IBM Java 6.0.16.2 IBM Java 6.0.16.16 IBM Java 6.0.16.15 IBM Java 6.0.16.1 IBM Java 6.0.16.0 IBM Aix 7.2 IBM AIX 7.1 IBM AIX 6.1
Not Vulnerable:	IBM Java 8.0.5.25 IBM Java 7.1.4.35 IBM Java 7.0.10.35 IBM Java 6.1.8.75 IBM Java 6.0.16.75

Oracle Java SE/Java SE Embedded CVE-2018-3136 Remote Security Vulnerability

Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability.

The vulnerability can be exploited over multiple protocols. This issue affects the 'Security' component.

This vulnerability affects the following supported versions:
Java SE: 6u201, 7u191, 8u182, 11; Java SE Embedded: 8u181

Oracle Java SE/Java SE Embedded CVE-2018-3136 Remote Security Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle Java SE/Java SE Embedded CVE-2018-3136 Remote Security Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oracle Java SE/Java SE Embedded CVE-2018-3136 Remote Security Vulnerability

References:

• Oracle Homepage (Oracle)
  
• Oracle Critical Patch Update Advisory - October 2018 (Oracle)
  
• Oracle October 16 2018 CPU (1.6.0_211, 1.7.0_201, 1.8.0_191) (IBM)
  
• Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX (IBM)