CVE-2018-11055: RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release…

PriorityP424medium5.5CVSS 3.1

AVLACLPRLUINSUCHINAN

EPSS

0.43%

35.4th percentile

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability. Decoded PKCS #12 data in heap memory is not zeroized by MES before releasing the memory internally and a malicious local user could gain access to the unauthorized data by doing heap inspection.

Affected

26 ranges· showing 25

Vendor	Product	Version range	Fixed in
dell	bsafe	>= 4.0.0 < 4.0.11	4.0.11
dell	bsafe	>= 4.1.0 < 4.1.6.1	4.1.6.1
oracle	application_testing_suite	—	—
oracle	communications_analytics	—	—
oracle	communications_ip_service_activator	—	—
oracle	communications_ip_service_activator	—	—
oracle	core_rdbms	—	—
oracle	core_rdbms	—	—
oracle	core_rdbms	—	—
oracle	core_rdbms	—	—
oracle	core_rdbms	—	—
oracle	enterprise_manager_ops_center	—	—
oracle	enterprise_manager_ops_center	—	—
oracle	goldengate_application_adapters	—	—
oracle	jd_edwards_enterpriseone_tools	—	—
oracle	real_user_experience_insight	—	—
oracle	real_user_experience_insight	—	—
oracle	real_user_experience_insight	—	—
oracle	retail_predictive_application_server	—	—
oracle	retail_predictive_application_server	—	—
oracle	security_service	—	—
oracle	security_service	—	—
oracle	security_service	—	—
oracle	timesten_in-memory_database	< 18.1.4.1.0	18.1.4.1.0
rsa	bsafe_micro_edition_suite	>= unspecified < 4.0.11	4.0.11

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvdv3.04.4MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.