CVE-2018-2972
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). The supported...
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). The supported version that is affected is Java SE: 10.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). The supported version that is affected is Java SE: 10.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
- Record
CVE-2018-2972- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). The supported version that is affected is Java SE: 10.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
- Record
CVE-2018-2972- Updated
- 2026-11-02
EUVDEUVD-2018-14827 No score
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). The supported version that is affected is Java SE: 10.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
- Record
EUVD-2018-14827- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4236-7hj3-75v7
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). The supported...
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). The supported version that is affected is Java SE: 10.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
- Record
GHSA-4236-7hj3-75v7- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-2972
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). The supported version that is affected is Java SE: 10.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
- Record
UBUNTU-CVE-2018-2972- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10871-1 No score
java-11-openjdk-11.0.12.0-3.1 on GA media
These are all security issues fixed in the java-11-openjdk-11.0.12.0-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10871-1- Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:10872-1 No score
java-13-openjdk-13.0.8.0-3.1 on GA media
These are all security issues fixed in the java-13-openjdk-13.0.8.0-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10872-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10873-1 No score
java-15-openjdk-15.0.4.0-2.1 on GA media
These are all security issues fixed in the java-15-openjdk-15.0.4.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10873-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2083-1 No score
Security update for java-10-openjdk
This update for OpenJDK 10.0.2 fixes the following security issues:
-
CVE-2018-2940: the libraries sub-component contained an easily exploitable vulnerability that allowed attackers to compromise Java SE or Java SE Embedded over the network, potentially gaining unauthorized read access to data that's accessible to the server. [bsc#1101645]
-
CVE-2018-2952: the concurrency sub-component contained a difficult to exploit vulnerability that allowed attackers to compromise Java SE, Java SE Embedded, or JRockit over the network. This issue could have been abused to mount a partial denial-of-service attack on the server. [bsc#1101651]
-
CVE-2018-2972: the security sub-component contained a difficult to exploit vulnerability that allowed attackers to compromise Java SE over the network, potentially gaining unauthorized access to critical data or complete access to all Java SE accessible data. [bsc#1101655)
-
CVE-2018-2973: the JSSE sub-component contained a difficult to exploit vulnerability allowed attackers to compromise Java SE or Java SE Embedded over the network, potentially gaining the ability to create, delete or modify critical data or all Java SE, Java SE Embedded accessible data without authorization. [bsc#1101656]
Furthemore, the following bugs were fixed:
-
Properly remove the existing alternative for java before reinstalling it. [bsc#1096420]
-
idlj was moved to the *-devel package. [bsc#1096420]
- Record
SUSE-SU-2018:2083-1- Updated
- 2026-11-02
OSVUSN-3747-1 No score
openjdk-lts vulnerabilities
It was discovered that OpenJDK did not properly validate types in some situations. An attacker could use this to construct a Java class that could possibly bypass sandbox restrictions. (CVE-2018-2825, CVE-2018-2826)
It was discovered that the PatternSyntaxException class in OpenJDK did not properly validate arguments passed to it. An attacker could use this to potentially construct a class that caused a denial of service (excessive memory consumption). (CVE-2018-2952)
Daniel Bleichenbacher discovered a vulnerability in the Galois/Counter Mode (GCM) mode of operation for symmetric block ciphers in OpenJDK. An attacker could use this to expose sensitive information. (CVE-2018-2972)
- Record
USN-3747-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-10-openjdkSUSE:Linux Enterprise Module for Basesystem 15 |
before 10.0.2.0-3.3.3 | 10.0.2.0-3.3.3 |
openjdk-ltsUbuntu:18.04:LTS |
before 10.0.2+13-1ubuntu0.18.04.1, plus listed versions 9.0.4+12-2ubuntu49.0.4+12-4ubuntu110~46-4ubuntu110~46-5ubuntu110.0.1+10-1ubuntu210.0.1+10-3ubuntu1 |
10.0.2+13-1ubuntu0.18.04.1 |
java-11-openjdkopenSUSE:Tumbleweed |
before 11.0.12.0-3.1 | 11.0.12.0-3.1 |
java-13-openjdkopenSUSE:Tumbleweed |
before 13.0.8.0-3.1 | 13.0.8.0-3.1 |
java-15-openjdkopenSUSE:Tumbleweed |
before 15.0.4.0-2.1 | 15.0.4.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-2972 is a medium vulnerability (CVSS 5.9) in Oracle Corporation Java, published July 18, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.58%, the 89th percentile. Fixed in java-10-openjdk 10.0.2.0-3.3.3.
References
oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
security.netapp.com/advisory/ntap-20180726-0001
usn.ubuntu.com/3747-1
securityfocus.com/bid/104782
securitytracker.com/id/1041302
nvd.nist.gov/vuln/detail/CVE-2018-2972
Show 108 moreShow less
github.com/advisories/GHSA-4236-7hj3-75v7
suse.com/support/update/announcement/2018/suse-su-20182083-1
bugzilla.suse.com/1096420
ubuntu.com/security/CVE-2018-2972
cve.org/CVERecord?id=CVE-2018-2972