Vulnerability record · CVE-2018-2825 · published 19 April 2018

CVE-2018-2825: Oracle jdk vulnerability

Oracle · Jdk

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). The supported version that is affected is Java SE: 10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

8.3 CVSS 3.1 High EPSS 4.1% · top 9.6%

8.3CVSS 3.1 base score, v2 5.1

4.1%EPSS exploitation probability, 30 days

NoNot in CISA KEV

17Affected product versions listed by NVD

12References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

17 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ubuntu Linux Canonical NCloud Backup Netapp NE Series Santricity Management Netapp NE Series Santricity Os Controller Netapp NE Series Santricity Storage Manager Netapp NE Series Santricity Web Services Netapp NOncommand Insight Netapp NOncommand Unified Manager Netapp NOncommand Workflow Automation Netapp NSantricity Cloud Connector Netapp NSnapmanager Netapp NStorage Replication Adapter Netapp NStoragegrid Netapp NVasa Provider Netapp NVirtual Storage Console Netapp

Jdk Oracle

Jre Oracle

References

Link	Tags
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	PatchVendor Advisory
http://www.securityfocus.com/bid/103782	Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040697	Broken LinkThird Party AdvisoryVDB Entry
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0	Broken Link
https://security.netapp.com/advisory/ntap-20180419-0001/	Third Party Advisory
https://usn.ubuntu.com/3747-1/	Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	PatchVendor Advisory
http://www.securityfocus.com/bid/103782	Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040697	Broken LinkThird Party AdvisoryVDB Entry
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0	Broken Link
https://security.netapp.com/advisory/ntap-20180419-0001/	Third Party Advisory
https://usn.ubuntu.com/3747-1/	Third Party Advisory

Track CVE-2018-2825 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-42013Apache HTTP Server path traversal and RCE via incomplete fixThe fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient, leaving a path traversal flaw that lets attackers map URLs to files outside…KEVEPSS 100%analysed7 Oct 2021 9.8CVE-2021-41773Apache HTTP Server 2.4.49 path traversal and RCEA path normalization flaw introduced in Apache HTTP Server 2.4.49 lets attackers map URLs to files outside directories configured by Alias-like direc…KEVEPSS 100%analysed5 Oct 2021 9.8CVE-2020-11651SaltStack Salt master authentication bypass in ClearFuncsSaltStack Salt before 2019.2.4 and 3000 before 3000.2 fails to properly validate method calls in the salt-master ClearFuncs class, allowing remote un…KEVEPSS 97%analysed30 Apr 2020 9.8CVE-2020-7247OpenSMTPD MAIL FROM command injection allows remote root code executionOpenSMTPD 6.6, as shipped in OpenBSD 6.6 and other products, mishandles input validation in smtp_mailaddr in smtp_session.c, returning an incorrect v…KEVEPSS 99%analysed29 Jan 2020 9.8CVE-2019-11043PHP-FPM buffer overflow enables remote code executionPHP-FPM in certain configurations writes past allocated buffers into FCGI protocol data space, an out-of-bounds write (CWE-787, CWE-120). It affects …KEVEPSS 100%analysed28 Oct 2019 9.8CVE-2019-16928Exim heap buffer overflow in string_vformat via long EHLO commandExim 4.92 through 4.92.2 contains a heap-based buffer overflow in string_vformat in string.c triggered by a long EHLO command, allowing remote code e…KEVEPSS 42%analysed27 Sep 2019 9.8CVE-2019-10149Exim MTA improper recipient validation leads to remote command executionExim versions 4.87 through 4.91 fail to properly validate recipient addresses in the deliver_message() function in /src/deliver.c, allowing command i…KEVEPSS 100%analysed5 Jun 2019 9.8CVE-2018-6789Exim SMTP base64d buffer overflow allows remote code executionExim before 4.90.1 contains a buffer overflow in the base64d function of its SMTP listener. A handcrafted message can trigger the overflow, and the f…KEVEPSS 82%analysed8 Feb 2018

Source: NIST National Vulnerability Database (record CVE-2018-2825), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.