Security Bulletin: Java SE issues disclosed in the Oracle April 2018 Critical Patch Update affects IBM Platform Cluster Manager Standard Edition, IBM Platform Cluster Manager Advanced Edition, Platform HPC, and Spectrum Cluster Foundation

Vulnerability Details

CVE Descriptions

CVE-2018-2826 (CVSS 8.3)

Description
A flaw in the VM causes type confusion and potentially allows an untrusted code running under a security manager to elevate its privileges.
The fix corrects the flaw.
Product Applicability
This issue is exploitable if the JRE is running untrusted code under a security manager (including untrusted applets or Web Start applications).
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2825 (CVSS 8.3)
Description
A flaw in the VM causes type confusion and potentially allows an untrusted code running under a security manager to elevate its privileges.
The fix corrects the flaw.
Product Applicability
This issue is exploitable if the JRE is running untrusted code under a security manager (including untrusted applets or Web Start applications).
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2814 (CVSS 8.3)
Description
A flaw in the Oracle HotSpot VM exposes reclaimed memory which may cause JVM crashes, expose sensitive information, or allow untrusted code to elevate its privileges.
The fix addresses the flaw.
Product Applicability
This issue applies to Solaris, HP-UX and Mac OS only.
This issue is exploitable if the JRE is running untrusted code under a security manager (including untrusted applets or Web Start applications).
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2794 (CVSS 7.7)
Description
A flaw in the JCE component may allow arbitrary code execution via malicious serialized data in keystores.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product Applicability
This issue is applicable if keytool is used on a keystore from an untrusted source.
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2783 (CVSS 7.4)
Description
A flaw in TLS handshaking related to previously implemented 3Shake countermeasures.
The fix addresses the vulnerability by implementing RFC 7627.
Product Applicability
This issue affects applications that use TLS.
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2815 (CVSS 5.3)
Description
A flaw in the ORB component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product Applicability
This issue does not apply to the IBM JRE/SDK, including the Hybrid JREs/SDKs on Solaris, HP-UX and Mac OS.
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2799 (CVSS 5.3)
Description
A flaw in the JAXP component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product Applicability
This issue is applicable if the JRE deserializes serialized object data from untrusted sources.
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2798 (CVSS 5.3)
Description
A flaw in the AWT component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product Applicability
This issue is applicable if the JRE deserializes serialized object data from untrusted sources.
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2797 (CVSS 5.3)
Description
A flaw in the JMX component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product Applicability
This issue is applicable if the JRE deserializes serialized object data from untrusted sources.
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2796 (CVSS 5.3)
Description
A flaw in the java.lang.util.concurrent component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product Applicability
This issue is applicable if the JRE deserializes serialized object data from untrusted sources.
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2795 (CVSS 5.3)
Description
A flaw in the java.util component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product Applicability
This issue is applicable if the JRE deserializes serialized object data from untrusted sources.
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2800 (CVSS 4.2)
Description
RMI will accept HTTP connections by default, which may allow an RMI server to be exposed by XSS attacks.
The fix disables inbound HTTP connections by default. They can re-enabled if necessary by setting this system property:
java.rmi.server.disableIncomingHttp=false
Product Applicability
This issue applies to Java deployments that use an RMI server.
Mitigation
The only solution is to upgrade the JRE.

CVE-2018-2790 (CVSS 3.1)
Description
A flaw in JAR parser allowed attributes to be added to a signed JAR's manifest without breaking signature verification.
The fix ensures that any modification of manifest attributes prevents signature verification.
Product Applicability
This issue affects applications which rely on signed JARs for integrity purposes.
This issue is also applicable if the JRE is installed as a system JRE, such that it is used to launch and execute applets in a browser, or to launch applications via Java Web Start.
Mitigation
The only solution is to upgrade the JRE.