NetSight
IP …
critical9.8

CVE-2018-14718

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from poly…

Impact

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.6.7.3
from 2.7.0 before 2.7.9.5
from 2.8.0 before 2.8.11.3
from 2.9.0 before 2.9.7
DebianDebian Linux
Versions 8.0, 9.0
OracleBanking Platform
Versions 2.5.0, 2.6.0, 2.6.1, 2.6.2
OracleBusiness Process Management Suite
Versions 12.1.3.0.0, 12.2.1.3.0
OracleCommunications Billing And Revenue Management
Versions 7.5, 12.0
OracleCommunications Instant Messaging Server
Version 10.0.1.3.0
OracleEnterprise Manager For Virtualization
Versions 13.2.2, 13.2.3, 13.3.1
OracleFinancial Services Analytical Applications Infrastructure
Versions 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7
OracleGlobal Lifecycle Management Opatch
before 11.2.0.3.23
from 12.2.0.1.0 before 12.2.0.1.19
from 13.9.4.0.0 before 13.9.4.2.1
OracleJd Edwards Enterpriseone Orchestrator
Version 9.2
OracleJd Edwards Enterpriseone Tools
Version 9.2
OracleJdeveloper
Versions 12.1.3.0.0, 12.2.1.3.0

Weakness classification

CWE-502

References