Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-2698

CWE-787 — Out-of-bounds Write9 documents9 sources
Severity
8.1HIGH
EPSS
4.7%
top 10.59%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
16
HP XP7 Command ViewOracle Corporation JavaCanonical Ubuntu Linux+13 more
Timeline
PublishedApr 23
Latest updateMay 24

Description

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets …

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages10 packages

▶CVEListV5oracle_corporation/javaJava SE: 7u211, 8u202
▶NVDoracle/jdk1.7.0, 1.8.0+1
▶NVDoracle/jre1.7.0, 1.8.0+1
▶NVDhp/xp7_command_view< 8.6.5-00
▶Debianopenjdk-11< 11.0.3+7-1

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 16.04, 18.04, 18.10, 19.04, Enterprise Linux 8.0, 8.1, 8.2, 8.4, 8.6, Openshift Container Platform 3.11

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-p55v-v6gp-5c6j: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)↗2022-05-24
▶
CVEList
CVE-2019-2698: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)↗2019-04-23
▶
OSV
CVE-2019-2698: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)↗2019-04-23
▶

💥Exploits & PoCs

1
Exploit-DB
Oracle Java Runtime Environment - Heap Corruption During TTF font Rendering in GlyphIterator::setCurrGlyphID↗2019-04-17
▶

📋Vendor Advisories

3
Ubuntu
OpenJDK vulnerabilities↗2019-05-13
▶
Red Hat
OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)↗2019-04-16
▶
Debian
CVE-2019-2698: openjdk-11 - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Sup...↗2019
▶

💬Community

1
Bugzilla
CVE-2019-2698 OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)↗2019-04-16
▶