TI-2019-02248 Aliases CVE-2019-2699 GHSA-xwm4-mmfg-2v6c

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL).

MEDIUM 46Published 2019-04-23 · Updated 2024-10-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL). The supported version that is affected is Java SE: 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02906 87th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Oracle	Java	Java SE: 8u202	—	No fix listed	CNA

Java VendorOracle Affected Java SE: 8u202 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:oracle:jdk:1.8.0:update202::::::	1.8.0 update202	Vulnerable	Oracle
cpe:2.3:a:oracle:jre:1.8.0:update202::::::	1.8.0 update202	Vulnerable	Oracle

cpe:2.3:a:oracle:jdk:1.8.0:update202:*:*:*:*:*:* Versions 1.8.0 update202 Vulnerable ·Oracle
cpe:2.3:a:oracle:jre:1.8.0:update202:*:*:*:*:*:* Versions 1.8.0 update202 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-2699
2026-10-03 Alias added: GHSA-xwm4-mmfg-2v6c

References

Patch 1

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Advisory 2

TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
TI-2015-02278 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… KEVCVSS 3.1CRITICAL 9.8
TI-2013-00349 Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to… KEVCVSS 3.1CRITICAL 9.8
TI-2012-03989 Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
TI-2012-01511 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
TI-2011-03122 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK… KEVCVSS 3.1CRITICAL 9.8

See all 804 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences