Read the docs
TI-2018-01976 Aliases CVE-2018-2657GHSA-qq7j-frwj-qh26

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent…

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 19 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u171 and 7u161; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07525 94th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 19 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OracleJavaJava SE: 6u171; 7u161; JRockit: R28.3.16—No fix listedCNA
  • Java VendorOracle Affected Java SE: 6u171; 7u161; JRockit: R28.3.16 Fixed in — No fix listed CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:oracle:jdk:1.6.0:update171:*:*:*:*:*:*1.6.0 update171VulnerableOracle
cpe:2.3:a:oracle:jdk:1.7.0:update161:*:*:*:*:*:*1.7.0 update161VulnerableOracle
cpe:2.3:a:oracle:jre:1.6.0:update171:*:*:*:*:*:*1.6.0 update171VulnerableOracle
cpe:2.3:a:oracle:jre:1.7.0:update161:*:*:*:*:*:*1.7.0 update161VulnerableOracle
cpe:2.3:a:oracle:jrockit:r28.3.16:*:*:*:*:*:*:*r28.3.16VulnerableOracle
cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*5.6VulnerableRed Hat
cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*5.7VulnerableRed Hat
cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*5.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
  • cpe:2.3:a:oracle:jdk:1.6.0:update171:*:*:*:*:*:* Versions 1.6.0 update171 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.7.0:update161:*:*:*:*:*:* Versions 1.7.0 update161 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jre:1.6.0:update171:*:*:*:*:*:* Versions 1.6.0 update171 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jre:1.7.0:update161:*:*:*:*:*:* Versions 1.7.0 update161 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jrockit:r28.3.16:*:*:*:*:*:*:* Versions r28.3.16 Vulnerable ·Oracle
  • cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:* Versions 5.7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:*:*:*:*:*:*:*:*before 7.6.0VulnerableSchneider Electric
cpe:2.3:a:hp:xp_command_view:*:*:*:*:advanced:*:*:*8.6.2-01VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:xp_p9000_command_view:*:*:*:*:advanced:*:*:*8.6.2-01VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:*8.6.2-01VulnerableHewlett Packard Enterprise
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:a:schneider-electric:struxureware_data_center_expert:*:*:*:*:*:*:*:* Versions before 7.6.0 Vulnerable ·Schneider Electric
  • cpe:2.3:a:hp:xp_command_view:*:*:*:*:advanced:*:*:* Versions 8.6.2-01 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:xp_p9000_command_view:*:*:*:*:advanced:*:*:* Versions 8.6.2-01 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:* Versions 8.6.2-01 Vulnerable ·Hewlett Packard Enterprise

Remediation

Red Hat 6 advisories

  • RHSA-2018:1812 Released 2018-06-07 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Satellite 5.6 (RHEL v.6) java-1.7.1-ibm-1:1.7.1.4.20-1jpp.3.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.20-1jpp.3.el6_9
    • Red Hat Satellite 5.7 (RHEL v.6) java-1.7.1-ibm-1:1.7.1.4.20-1jpp.3.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.20-1jpp.3.el6_9
  • RHSA-2018:1463 Released 2018-05-15 · Red Hat rating Moderate
    java-1.8.0-ibm security update
    • Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm-1:1.8.0.5.10-1jpp.1.el6_9, java-1.8.0-ibm-devel-1:1.8.0.5.10-1jpp.1.el6_9
  • RHSA-2018:0521 Released 2018-03-14 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.20-1jpp.3.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.20-1jpp.3.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.20-1jpp.3.el6_9 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.20-1jpp.3.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.20-1jpp.3.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.20-1jpp.3.el6_9 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.20-1jpp.3.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.20-1jpp.3.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.20-1jpp.3.el6_9 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.20-1jpp.3.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.20-1jpp.3.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.20-1jpp.3.el6_9 +3
Show 3 more Red Hat advisories
  • RHSA-2018:0458 Released 2018-03-07 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.20-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.20-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.20-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.20-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.20-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.20-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.20-1jpp.1.el7, java-1.7.1-ibm-1:1.7.1.4.20-1jpp.1.el7.ppc, java-1.7.1-ibm-demo-1:1.7.1.4.20-1jpp.1.el7 +6
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.20-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.20-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.20-1jpp.1.el7 +3
  • RHSA-2018:0115 Released 2018-01-22 · Red Hat rating Important
    java-1.6.0-sun security update
    • Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.6.0-sun-1:1.6.0.181-1jpp.2.el7, java-1.6.0-sun-demo-1:1.6.0.181-1jpp.2.el7, java-1.6.0-sun-devel-1:1.6.0.181-1jpp.2.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.6.0-sun-1:1.6.0.181-1jpp.2.el7, java-1.6.0-sun-demo-1:1.6.0.181-1jpp.2.el7, java-1.6.0-sun-devel-1:1.6.0.181-1jpp.2.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.6.0-sun-1:1.6.0.181-1jpp.1.el6, java-1.6.0-sun-demo-1:1.6.0.181-1jpp.1.el6, java-1.6.0-sun-devel-1:1.6.0.181-1jpp.1.el6 +3
    • Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.6.0-sun-1:1.6.0.181-1jpp.1.el6, java-1.6.0-sun-demo-1:1.6.0.181-1jpp.1.el6, java-1.6.0-sun-devel-1:1.6.0.181-1jpp.1.el6 +3
    • Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.6.0-sun-1:1.6.0.181-1jpp.2.el7, java-1.6.0-sun-demo-1:1.6.0.181-1jpp.2.el7, java-1.6.0-sun-devel-1:1.6.0.181-1jpp.2.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Server 6 java-1.6.0-sun-1:1.6.0.181-1jpp.1.el6, java-1.6.0-sun-demo-1:1.6.0.181-1jpp.1.el6, java-1.6.0-sun-devel-1:1.6.0.181-1jpp.1.el6 +3
    • Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.6.0-sun-1:1.6.0.181-1jpp.2.el7, java-1.6.0-sun-demo-1:1.6.0.181-1jpp.2.el7, java-1.6.0-sun-devel-1:1.6.0.181-1jpp.2.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Workstation 6 java-1.6.0-sun-1:1.6.0.181-1jpp.1.el6, java-1.6.0-sun-demo-1:1.6.0.181-1jpp.1.el6, java-1.6.0-sun-devel-1:1.6.0.181-1jpp.1.el6 +3
  • RHSA-2018:0100 Released 2018-01-18 · Red Hat rating Important
    java-1.7.0-oracle security update
    • Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.7.0-oracle-1:1.7.0.171-1jpp.1.el7, java-1.7.0-oracle-devel-1:1.7.0.171-1jpp.1.el7, java-1.7.0-oracle-javafx-1:1.7.0.171-1jpp.1.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.7.0-oracle-1:1.7.0.171-1jpp.1.el7, java-1.7.0-oracle-devel-1:1.7.0.171-1jpp.1.el7, java-1.7.0-oracle-javafx-1:1.7.0.171-1jpp.1.el7 +1
    • Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.7.0-oracle-1:1.7.0.171-1jpp.1.el6_9, java-1.7.0-oracle-devel-1:1.7.0.171-1jpp.1.el6_9, java-1.7.0-oracle-javafx-1:1.7.0.171-1jpp.1.el6_9 +3
    • Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.7.0-oracle-1:1.7.0.171-1jpp.1.el6_9, java-1.7.0-oracle-devel-1:1.7.0.171-1jpp.1.el6_9, java-1.7.0-oracle-javafx-1:1.7.0.171-1jpp.1.el6_9 +3
    • Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.7.0-oracle-1:1.7.0.171-1jpp.1.el7, java-1.7.0-oracle-devel-1:1.7.0.171-1jpp.1.el7, java-1.7.0-oracle-javafx-1:1.7.0.171-1jpp.1.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Server 6 java-1.7.0-oracle-1:1.7.0.171-1jpp.1.el6_9, java-1.7.0-oracle-devel-1:1.7.0.171-1jpp.1.el6_9, java-1.7.0-oracle-javafx-1:1.7.0.171-1jpp.1.el6_9 +3
    • Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.7.0-oracle-1:1.7.0.171-1jpp.1.el7, java-1.7.0-oracle-devel-1:1.7.0.171-1jpp.1.el7, java-1.7.0-oracle-javafx-1:1.7.0.171-1jpp.1.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Workstation 6 java-1.7.0-oracle-1:1.7.0.171-1jpp.1.el6_9, java-1.7.0-oracle-devel-1:1.7.0.171-1jpp.1.el6_9, java-1.7.0-oracle-javafx-1:1.7.0.171-1jpp.1.el6_9 +3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Oracle Java — RHSA-2018:1463

    17 records Highest priority Priority MEDIUM 6 MEDIUM, 11 LOW

    Other records, highest priority first

    • TI-2018-01952 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 47
    • TI-2018-01957 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment).Priority MEDIUM 44
    • TI-2018-01958 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment).Priority MEDIUM 43
    Show all 17 records → Advisory →
  • Advisory ·

    Oracle Java — RHSA-2018:0458

    15 records Highest priority Priority MEDIUM 4 MEDIUM, 11 LOW

    Other records, highest priority first

    • TI-2018-01952 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 47
    • TI-2018-01956 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 42
    • TI-2018-01922 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 40
    Show all 15 records → Advisory →
Show 4 more groups
  • Advisory ·

    Oracle Java — RHSA-2018:0521

    15 records Highest priority Priority MEDIUM 4 MEDIUM, 11 LOW

    Other records, highest priority first

    • TI-2018-01952 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 47
    • TI-2018-01956 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 42
    • TI-2018-01922 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 40
    Show all 15 records → Advisory →
  • Advisory ·

    Oracle Java — RHSA-2018:0100

    14 records Highest priority Priority MEDIUM 4 MEDIUM, 10 LOW

    Other records, highest priority first

    • TI-2018-01952 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 47
    • TI-2018-01956 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 42
    • TI-2018-01922 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 40
    Show all 14 records → Advisory →
  • Advisory ·

    Oracle Java — RHSA-2018:1812

    14 records Highest priority Priority MEDIUM 4 MEDIUM, 10 LOW

    Other records, highest priority first

    • TI-2018-01952 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 47
    • TI-2018-01956 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 42
    • TI-2018-01922 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 40
    Show all 14 records → Advisory →
  • Advisory ·

    Oracle Java — RHSA-2018:0115

    13 records Highest priority Priority MEDIUM 4 MEDIUM, 9 LOW

    Other records, highest priority first

    • TI-2018-01952 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 47
    • TI-2018-01956 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 42
    • TI-2018-01922 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…Priority MEDIUM 40
    Show all 13 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Oracle Java for Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2018:0100, RHSA-2018:0115
Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7)Fixed RHSA-2018:0100, RHSA-2018:0115
Oracle Java for Red Hat Enterprise Linux Desktop 6Fixed RHSA-2018:0100, RHSA-2018:0115
Oracle Java for Red Hat Enterprise Linux HPC Node 6Fixed RHSA-2018:0100, RHSA-2018:0115
Oracle Java for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2018:0100, RHSA-2018:0115
Oracle Java for Red Hat Enterprise Linux Server 6Fixed RHSA-2018:0100, RHSA-2018:0115
Oracle Java for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2018:0100, RHSA-2018:0115
Oracle Java for Red Hat Enterprise Linux Workstation 6Fixed RHSA-2018:0100, RHSA-2018:0115
Red Hat Enterprise Linux Client Supplementary (v. 7)Fixed RHSA-2018:0458
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)Fixed RHSA-2018:0458
Red Hat Enterprise Linux Desktop Supplementary (v. 6)Fixed RHSA-2018:0521
Red Hat Enterprise Linux HPC Node Supplementary (v. 6)Fixed RHSA-2018:0521
Red Hat Enterprise Linux Server Supplementary (v. 6)Fixed RHSA-2018:0521
Red Hat Enterprise Linux Server Supplementary (v. 7)Fixed RHSA-2018:0458
Red Hat Enterprise Linux Workstation Supplementary (v. 6)Fixed RHSA-2018:0521
Red Hat Enterprise Linux Workstation Supplementary (v. 7)Fixed RHSA-2018:0458
Red Hat Satellite 5.6 (RHEL v.6)Fixed RHSA-2018:1812
Red Hat Satellite 5.7 (RHEL v.6)Fixed RHSA-2018:1812
Red Hat Satellite 5.8 (RHEL v.6)Fixed RHSA-2018:1463

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-2657
  2. 2026-10-03 Alias added: GHSA-qq7j-frwj-qh26

References

Patch 1

Advisory 9

  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-02278 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-00349 Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-03989 Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-01511 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
  • TI-2011-03122 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK… KEVCVSS 3.1CRITICAL 9.8
See all 804 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences