CVE-2018-3246
published 2018-10-17CVE-2018-3246: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are…
PriorityP350high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
2.89%
85.4th percentile
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | communications_converged_application_server | < 7.0.0.1 | 7.0.0.1 |
| oracle | communications_webrtc_session_controller | < 7.2 | 7.2 |
| oracle | enterprise_repository | — | — |
| oracle | retail_convenience_and_fuel_pos_software | — | — |
| oracle | utilities_network_management_system | — | — |
| oracle | utilities_network_management_system | — | — |
| oracle | utilities_network_management_system | — | — |
| oracle | utilities_network_management_system | — | — |
| oracle | webcenter_portal | — | — |
| oracle | webcenter_portal | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-18198 libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c
bugzilla·2018-02-27·CVSS 8.8
CVE-2017-18198 [HIGH] CVE-2017-18198 libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c
CVE-2017-18198 libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c
A heap corruption bug was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files, thus resulting in local DoS.
Upstream issue:
https://savannah.gnu.org/bugs/?52265
Upstream release:
http://ftp.gnu.org/gnu/libcdio/libcdio-1.0.0.tar.gz
Discussion:
Created libcdio tracking bugs for this issue:
Affects: fedora-all [bug 1549713]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:3246 https://access.redhat.com/errata/RHSA-2018:3246
Bugzilla
CVE-2017-18199 libcdio: NULL pointer dereference in realloc_symlink in rock.c
bugzilla·2018-02-27·CVSS 6.5
CVE-2017-18199 [MEDIUM] CVE-2017-18199 libcdio: NULL pointer dereference in realloc_symlink in rock.c
CVE-2017-18199 libcdio: NULL pointer dereference in realloc_symlink in rock.c
The realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted ISO file.
Upstream issue:
https://savannah.gnu.org/bugs/?52264
Discussion:
Created libcdio tracking bugs for this issue:
Affects: fedora-all [bug 1549713]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:3246 https://access.redhat.com/errata/RHSA-2018:3246
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/105628http://www.securitytracker.com/id/1041896https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/105628http://www.securitytracker.com/id/1041896https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
2018-10-17
Published