High severity · published Feb 22, 2018
CVE-2018-1417
Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevate its privileges
8.1
CVSS
2.1%
EPSS
No
On KEV
Description
Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevate its privileges. IBM X-Force ID: 138823.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Java Sdk · Ibm
6.0.0.0; 6.1.0.0; 7.0.0.0; 7.1.0.0; 8.0.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1417
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1417
www.ibm.com
http://www.ibm.com/support/docview.wss?uid=isg3T1027315
www.ibm.com
http://www.ibm.com/support/docview.wss?uid=swg22014937
Third Party Advisory
http://www.securityfocus.com/bid/103216
Third Party Advisory
http://www.securitytracker.com/id/1040403
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:1463
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/138823
More from Java Sdk
9.1
CVE-2015-5041
The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive…
8.1
CVE-2016-0376
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40),…
8.1
CVE-2016-0363
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1…
5.9
CVE-2024-27267
The Object Request Broker (ORB) in IBM SDK, Java Technology Edition 7.1.0.0 through 7.1.5.18 and 8.0.0.0 through 8.0.8.26 is vulnerable to remote denial of service, caused by a…
5.6
CVE-2016-0264
Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40…