NetSight
IP …
critical9.8

CVE-2018-14719

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds…

Impact

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.6.7.3
from 2.7.0 before 2.7.9.5
from 2.8.0 before 2.8.11.3
from 2.9.0 before 2.9.7
DebianDebian Linux
Versions 8.0, 9.0
OracleBanking Platform
Versions 2.5.0, 2.6.0, 2.6.1, 2.6.2
OracleBusiness Process Management Suite
Versions 12.1.3.0.0, 12.2.1.3.0
OracleClusterware
Version 12.1.0.2.0
OracleCommunications Billing And Revenue Management
Versions 7.5, 12.0
OracleDatabase Server
Versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
OracleEnterprise Manager For Virtualization
Versions 13.2.2, 13.2.3, 13.3.1
OracleFinancial Services Analytical Applications Infrastructure
Versions 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7
OracleGlobal Lifecycle Management Opatch
before 11.2.0.3.23
from 12.2.0.1.0 before 12.2.0.1.19
from 13.9.4.0.0 before 13.9.4.2.1
OracleJdeveloper
Versions 12.1.3.0.0, 12.2.1.3.0
OraclePrimavera P6 Enterprise Project Portfolio Management
from 17.7 through 17.12
Versions 15.1, 15.2, 16.1, 16.2, 18.8

Weakness classification

CWE-502

References