CVE-2019-2894

Опубликовано: 16 окт. 2019

Источник: nvd

CVSS3: 3.7

CVSS2: 4.3

EPSS Низкий

Описание

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00031.html
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/02/2
Mailing List
Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Patch
Vendor Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10315
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/12/msg00005.html
Mailing List
Third Party Advisory
https://minerva.crocs.fi.muni.cz/
Third Party Advisory
https://seclists.org/bugtraq/2019/Oct/27
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Oct/31
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20191017-0001/
Third Party Advisory
https://usn.ubuntu.com/4223-1/
Third Party Advisory
https://www.debian.org/security/2019/dsa-4546
Third Party Advisory
https://www.debian.org/security/2019/dsa-4548
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00031.html
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/02/2
Mailing List
Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Patch
Vendor Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10315
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:oracle:jdk:1.7.0:update231:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.8.0:update221:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:11.0.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:13.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.7.0:update231:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.8.0:update221:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:11.0.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:13.0.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*

cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*

cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*

cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*

cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*

cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*

cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*

cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*

cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

EPSS

Процентиль: 57%

0.00349

Низкий

3.7 Low

CVSS3

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2019-2894

CVSS3: 3.7

ubuntu

больше 6 лет назад

CVE-2019-2894

CVSS3: 3.7

redhat

больше 6 лет назад

CVE-2019-2894

CVSS3: 3.7

debian

больше 6 лет назад

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java ...

GHSA-vm3x-xpcr-m2cg

CVSS3: 3.7

github

больше 3 лет назад

BDU:2019-04135

CVSS3: 3.7

fstec

больше 6 лет назад

Уязвимость компонента Security программных платформ Java SE и Java SE Embedded, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 57%

0.00349

Низкий

3.7 Low

CVSS3

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo