Vulnerability-Lookup

usn-3644-1

Vulnerability from osv_ubuntu

Published

2018-05-11 01:44

Modified

2026-02-10 04:41

Summary

openjdk-8 vulnerabilities

Details

It was discovered that the Security component of OpenJDK did not correctly perform merging of multiple sections for the same file listed in JAR archive file manifests. An attacker could possibly use this to modify attributes in a manifest without invalidating the signature. (CVE-2018-2790)

Francesco Palmarini, Marco Squarcina, Mauro Tempesta, and Riccardo Focardi discovered that the Security component of OpenJDK did not restrict which classes could be used when deserializing keys from the JCEKS key stores. An attacker could use this to specially craft a JCEKS key store to execute arbitrary code. (CVE-2018-2794)

It was discovered that the Security component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2795)

It was discovered that the Concurrency component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2796)

It was discovered that the JMX component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2797)

It was discovered that the AWT component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2798)

It was discovered that the JAXP component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2799)

Moritz Bechler discovered that the RMI component of OpenJDK enabled HTTP transport for RMI servers by default. A remote attacker could use this to gain access to restricted services. (CVE-2018-2800)

It was discovered that a vulnerability existed in the Hotspot component of OpenJDK affecting confidentiality, data integrity, and availability. An attacker could use this to specially craft an Java application that caused a denial of service or bypassed sandbox restrictions. (CVE-2018-2814)

Apostolos Giannakidis discovered that the Serialization component of OpenJDK did not properly bound memory allocations in some situations. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2815)

David Benjamin discovered a vulnerability in the Security component of OpenJDK related to data integrity and confidentiality. A remote attacker could possibly use this to expose sensitive information. (CVE-2018-2783)

References

URL

Type

	https://ubuntu.com/security/notices/USN-3644-1	ADVISORY
	https://ubuntu.com/security/CVE-2018-2783	REPORT
	https://ubuntu.com/security/CVE-2018-2790	REPORT
	https://ubuntu.com/security/CVE-2018-2794	REPORT
	https://ubuntu.com/security/CVE-2018-2795	REPORT
	https://ubuntu.com/security/CVE-2018-2796	REPORT
	https://ubuntu.com/security/CVE-2018-2797	REPORT
	https://ubuntu.com/security/CVE-2018-2798	REPORT
	https://ubuntu.com/security/CVE-2018-2799	REPORT
	https://ubuntu.com/security/CVE-2018-2800	REPORT
	https://ubuntu.com/security/CVE-2018-2814	REPORT
	https://ubuntu.com/security/CVE-2018-2815	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2018-2783",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2790",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2794",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2795",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2796",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2797",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2798",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2799",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2800",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2814",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2815",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "openjdk-8-demo",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jdk",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jdk-headless",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jre",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jre-headless",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jre-jamvm",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jre-zero",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-source",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "openjdk-8",
        "purl": "pkg:deb/ubuntu/openjdk-8@8u171-b11-0ubuntu0.16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8u171-b11-0ubuntu0.16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8u66-b01-5",
        "8u72-b05-1ubuntu1",
        "8u72-b05-5",
        "8u72-b05-6",
        "8u72-b15-1",
        "8u72-b15-2ubuntu1",
        "8u72-b15-2ubuntu3",
        "8u72-b15-3ubuntu1",
        "8u77-b03-1ubuntu2",
        "8u77-b03-3ubuntu1",
        "8u77-b03-3ubuntu2",
        "8u77-b03-3ubuntu3",
        "8u91-b14-0ubuntu4~16.04.1",
        "8u91-b14-3ubuntu1~16.04.1",
        "8u111-b14-2ubuntu0.16.04.2",
        "8u121-b13-0ubuntu1.16.04.2",
        "8u131-b11-0ubuntu1.16.04.2",
        "8u131-b11-2ubuntu1.16.04.2",
        "8u131-b11-2ubuntu1.16.04.3",
        "8u151-b12-0ubuntu0.16.04.2",
        "8u162-b12-0ubuntu0.16.04.2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that the Security component of OpenJDK did not\ncorrectly perform merging of multiple sections for the same file listed\nin JAR archive file manifests. An attacker could possibly use this to\nmodify attributes in a manifest without invalidating the signature.\n(CVE-2018-2790)\n\nFrancesco Palmarini, Marco Squarcina, Mauro Tempesta, and Riccardo Focardi\ndiscovered that the Security component of OpenJDK did not restrict which\nclasses could be used when deserializing keys from the JCEKS key stores. An\nattacker could use this to specially craft a JCEKS key store to execute\narbitrary code. (CVE-2018-2794)\n\nIt was discovered that the Security component of OpenJDK in some situations\ndid not properly limit the amount of memory allocated when performing\ndeserialization. An attacker could use this to cause a denial of service\n(memory exhaustion). (CVE-2018-2795)\n\nIt was discovered that the Concurrency component of OpenJDK in some\nsituations did not properly limit the amount of memory allocated when\nperforming deserialization. An attacker could use this to cause a\ndenial of service (memory exhaustion). (CVE-2018-2796)\n\nIt was discovered that the JMX component of OpenJDK in some situations did\nnot properly limit the amount of memory allocated when performing\ndeserialization. An attacker could use this to cause a denial of service\n(memory exhaustion). (CVE-2018-2797)\n\nIt was discovered that the AWT component of OpenJDK in some situations did\nnot properly limit the amount of memory allocated when performing\ndeserialization. An attacker could use this to cause a denial of service\n(memory exhaustion). (CVE-2018-2798)\n\nIt was discovered that the JAXP component of OpenJDK in some situations did\nnot properly limit the amount of memory allocated when performing\ndeserialization. An attacker could use this to cause a denial of service\n(memory exhaustion). (CVE-2018-2799)\n\nMoritz Bechler discovered that the RMI component of OpenJDK enabled HTTP\ntransport for RMI servers by default. A remote attacker could use this to\ngain access to restricted services. (CVE-2018-2800)\n\nIt was discovered that a vulnerability existed in the Hotspot component of\nOpenJDK affecting confidentiality, data integrity, and availability. An\nattacker could use this to specially craft an Java application that caused\na denial of service or bypassed sandbox restrictions. (CVE-2018-2814)\n\nApostolos Giannakidis discovered that the Serialization component\nof OpenJDK did not properly bound memory allocations in some\nsituations. An attacker could use this to cause a denial of service\n(memory exhaustion). (CVE-2018-2815)\n\nDavid Benjamin discovered a vulnerability in the Security component\nof OpenJDK related to data integrity and confidentiality. A remote\nattacker could possibly use this to expose sensitive information.\n(CVE-2018-2783)\n",
  "id": "USN-3644-1",
  "modified": "2026-02-10T04:41:20Z",
  "published": "2018-05-11T01:44:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3644-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2783"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2790"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2794"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2795"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2796"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2797"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2798"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2799"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2800"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2814"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2815"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "openjdk-8 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2018-2783",
    "UBUNTU-CVE-2018-2790",
    "UBUNTU-CVE-2018-2794",
    "UBUNTU-CVE-2018-2795",
    "UBUNTU-CVE-2018-2796",
    "UBUNTU-CVE-2018-2797",
    "UBUNTU-CVE-2018-2798",
    "UBUNTU-CVE-2018-2799",
    "UBUNTU-CVE-2018-2800",
    "UBUNTU-CVE-2018-2814",
    "UBUNTU-CVE-2018-2815"
  ]
}

ubuntu-cve-2018-2815

Vulnerability from osv_ubuntu

Published

2018-04-18 00:00

Modified

2025-09-08 16:44

Summary

Details

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5.3 (Medium)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2018-2815	REPORT
	http://www.oracle.com/technetwork/security-adviso…	REPORT
	https://ubuntu.com/security/notices/USN-3644-1	ADVISORY
	https://ubuntu.com/security/notices/USN-3691-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2018-2815	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "icedtea-7-jre-jamvm",
            "binary_version": "7u181-2.6.14-0ubuntu0.1"
          },
          {
            "binary_name": "openjdk-7-demo",
            "binary_version": "7u181-2.6.14-0ubuntu0.1"
          },
          {
            "binary_name": "openjdk-7-jdk",
            "binary_version": "7u181-2.6.14-0ubuntu0.1"
          },
          {
            "binary_name": "openjdk-7-jre",
            "binary_version": "7u181-2.6.14-0ubuntu0.1"
          },
          {
            "binary_name": "openjdk-7-jre-headless",
            "binary_version": "7u181-2.6.14-0ubuntu0.1"
          },
          {
            "binary_name": "openjdk-7-jre-lib",
            "binary_version": "7u181-2.6.14-0ubuntu0.1"
          },
          {
            "binary_name": "openjdk-7-jre-zero",
            "binary_version": "7u181-2.6.14-0ubuntu0.1"
          },
          {
            "binary_name": "openjdk-7-source",
            "binary_version": "7u181-2.6.14-0ubuntu0.1"
          },
          {
            "binary_name": "openjdk-7-tests",
            "binary_version": "7u181-2.6.14-0ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "openjdk-7",
        "purl": "pkg:deb/ubuntu/openjdk-7@7u181-2.6.14-0ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7u181-2.6.14-0ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7u25-2.3.12-4ubuntu3",
        "7u25-2.3.12-4ubuntu5",
        "7u45-2.4.3-3ubuntu1",
        "7u45-2.4.3-3ubuntu2",
        "7u45-2.4.3-4ubuntu1",
        "7u45-2.4.3-4ubuntu2",
        "7u51-2.4.4-1ubuntu1",
        "7u51-2.4.5-1ubuntu1",
        "7u51-2.4.6~pre1-1ubuntu2",
        "7u51-2.4.6-1ubuntu3",
        "7u51-2.4.6-1ubuntu4",
        "7u55-2.4.7-1ubuntu1",
        "7u65-2.5.1-4ubuntu1~0.14.04.1",
        "7u65-2.5.1-4ubuntu1~0.14.04.2",
        "7u65-2.5.2-3~14.04",
        "7u71-2.5.3-0ubuntu0.14.04.1",
        "7u75-2.5.4-1~trusty1",
        "7u79-2.5.5-0ubuntu0.14.04.2",
        "7u79-2.5.6-0ubuntu1.14.04.1",
        "7u85-2.6.1-5ubuntu0.14.04.1",
        "7u91-2.6.3-0ubuntu0.14.04.1",
        "7u95-2.6.4-0ubuntu0.14.04.1",
        "7u95-2.6.4-0ubuntu0.14.04.2",
        "7u101-2.6.6-0ubuntu0.14.04.1",
        "7u111-2.6.7-0ubuntu0.14.04.3",
        "7u121-2.6.8-1ubuntu0.14.04.1",
        "7u121-2.6.8-1ubuntu0.14.04.3",
        "7u131-2.6.9-0ubuntu0.14.04.1",
        "7u131-2.6.9-0ubuntu0.14.04.2",
        "7u151-2.6.11-0ubuntu1.14.04.1",
        "7u151-2.6.11-2ubuntu0.14.04.1",
        "7u171-2.6.13-0ubuntu0.14.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "openjdk-8-demo",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jdk",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jdk-headless",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jre",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jre-headless",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jre-jamvm",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-jre-zero",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "openjdk-8-source",
            "binary_version": "8u171-b11-0ubuntu0.16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "openjdk-8",
        "purl": "pkg:deb/ubuntu/openjdk-8@8u171-b11-0ubuntu0.16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8u171-b11-0ubuntu0.16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8u66-b01-5",
        "8u72-b05-1ubuntu1",
        "8u72-b05-5",
        "8u72-b05-6",
        "8u72-b15-1",
        "8u72-b15-2ubuntu1",
        "8u72-b15-2ubuntu3",
        "8u72-b15-3ubuntu1",
        "8u77-b03-1ubuntu2",
        "8u77-b03-3ubuntu1",
        "8u77-b03-3ubuntu2",
        "8u77-b03-3ubuntu3",
        "8u91-b14-0ubuntu4~16.04.1",
        "8u91-b14-3ubuntu1~16.04.1",
        "8u111-b14-2ubuntu0.16.04.2",
        "8u121-b13-0ubuntu1.16.04.2",
        "8u131-b11-0ubuntu1.16.04.2",
        "8u131-b11-2ubuntu1.16.04.2",
        "8u131-b11-2ubuntu1.16.04.3",
        "8u151-b12-0ubuntu0.16.04.2",
        "8u162-b12-0ubuntu0.16.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "openjdk-8-demo",
            "binary_version": "8u171-b11-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "openjdk-8-jdk",
            "binary_version": "8u171-b11-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "openjdk-8-jdk-headless",
            "binary_version": "8u171-b11-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "openjdk-8-jre",
            "binary_version": "8u171-b11-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "openjdk-8-jre-headless",
            "binary_version": "8u171-b11-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "openjdk-8-jre-zero",
            "binary_version": "8u171-b11-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "openjdk-8-source",
            "binary_version": "8u171-b11-0ubuntu0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "openjdk-8",
        "purl": "pkg:deb/ubuntu/openjdk-8@8u171-b11-0ubuntu0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8u171-b11-0ubuntu0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8u144-b01-2",
        "8u151-b12-1",
        "8u162-b12-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).",
  "id": "UBUNTU-CVE-2018-2815",
  "modified": "2025-09-08T16:44:39Z",
  "published": "2018-04-18T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2815"
    },
    {
      "type": "REPORT",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3644-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3691-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-2815"
    }
  ],
  "related": [
    "USN-3644-1",
    "USN-3691-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2018-2815"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

usn-3644-1

Vulnerability from osv_ubuntu

ubuntu-cve-2018-2815

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature