3

I needed guidance on how to interpret

Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16.

The above phrase is from CVE-2018-2579.

Does it mean 8u152 and above are impacted or does that mean everything upto 8u152 and above uptil release with fix are impacted?

For instance, if we are running 8u144 - does it mean we are vulnerable?

  • 3
    Often such statements include only versions which are still supported. Thus, if you are running an older and unsupported version regard yourself as being vulnerable even if not explicitly said. – Steffen Ullrich Feb 2 '18 at 8:45
1

I would say those specific versions are the only ones that are vulnerable. If there are multiple versions Oracle usually writes "11.0.x" for example, or "Versions prior to 8.1" etc. So when they explicitly write out a couple of different versions numbers, that's probably the only ones that are vulnerable.

Source: http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html (they are doing it right here on their advisory)

(but as noted in a comment, if you are using an unsupported version, then that can be assumed to vulnerable to all kinds of things and you would never know)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.