CVE-2018-1417 Privilege escalation in SDK, Java Technology Edition

What is CVE-2018-1417?

CVE-2018-1417 is a high-severity vulnerability in IBM SDK, Java Technology Edition, published on 22 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevate its privileges. IBM X-Force ID: 138823.

Weakness: CWE-732

Which versions are affected by CVE-2018-1417?

It affects 1 product.

Products include Ibm Java Sdk.

How do I fix CVE-2018-1417?

Apply the vendor's patch.

Is CVE-2018-1417 being exploited?

There is no known exploitation of CVE-2018-1417 in the wild and no public exploit code.

Other vulnerabilities in IBM SDK, Java Technology Edition

• CVE-2014-8891 Security feature bypass in n/a Critical 10.0
• CVE-2015-5041 Information disclosure in n/a Critical 9.1
• CVE-2016-0363 Security feature bypass in n/a High 8.1
• CVE-2016-0376 Deserialization in n/a High 8.1
• CVE-2014-8892 Information disclosure in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hjv6-rx46-p2h8.