WaratekVRT Sign in

Oracle Critical Patch Update October 2018

Released October 2018 · Oracle's advisory ↗ · ← Critical Patch Update, July 2018 · Critical Patch Update, January 2019 →

226 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by Waratek, exploitedProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploitedNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update October 2018, one square per CVE: 105 Java CVEs, 22 protected by Waratek, 4 exploited, 121 other CVEs in this release.

Download the image

By status

22Protected by Waratek2Mitigation candidate81No exploit published46Outside Waratek scope75Not applicable 4Exploited, marked by the ring

No exploit published. For 81 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Protection: None✕
Overview 204 matches · 83 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 8 public PoC · 4 EPSS ≥ 0.5
204matches 83in Waratek scope40.7% 0protected0.0% 2exploited1.0% 0CISA KEV0.0% 8public PoC3.9% 4EPSS ≥ 0.52.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 1.0% No exploit published 81 39.7% Outside Waratek scope 46 22.5% Not applicable 75 36.8% Withdrawn CVE 0 0.0%
Critical 13 6.4% High 77 37.7% Medium 107 52.5% Low 7 3.4% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 204 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 1.0% Working exploit published 5 2.5% Proof of concept only 1 0.5% Forecast only 0 0.0% No public exploit 196 96.1%
split by peak 180 / quarter
Not applicable: 75Outside Waratek scope: 46No exploit published: 81Mitigation candidate: 2 Low: 7Medium: 107High: 77Critical: 13 not blocked: 204 No public exploit: 196Proof of concept only: 1Working exploit published: 5Exploited: 2
Q1 151 Outside Waratek scope1 High1 not blocked1 Working exploit published1 Q2 150 Q3 150 Q4 151 Not applicable1 Medium1 not blocked1 No public exploit1 Q1 160 Q2 163 Not applicable3 Critical1 High1 Medium1 not blocked3 Working exploit published1 No public exploit2 Q3 162 Outside Waratek scope1 Not applicable1 Critical1 High1 not blocked2 No public exploit2 Q4 161 Not applicable1 Critical1 not blocked1 No public exploit1 Q1 170 Q2 171 Outside Waratek scope1 Critical1 not blocked1 No public exploit1 Q3 171 Not applicable1 High1 not blocked1 Exploited1 Q4 172 Not applicable2 Critical1 Medium1 not blocked2 No public exploit2 Q1 185 Outside Waratek scope4 Not applicable1 Critical1 Medium4 not blocked5 Exploited1 Working exploit published1 Proof of concept only1 No public exploit2 Q2 186 No exploit published2 Outside Waratek scope1 Not applicable3 Critical2 High3 Medium1 not blocked6 No public exploit6 Q3 181 Not applicable1 Medium1 not blocked1 No public exploit1 Q4 18180 Mitigation candidate2 No exploit published79 Outside Waratek scope38 Not applicable61 Critical5 High70 Medium98 Low7 not blocked180 Working exploit published2 No public exploit178
Q2 15Q4 15Q2 16Q4 16Q2 17Q4 17Q2 18Q4 18
204 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2016-2107 Medium 2016-05-05 Not applicable Working exploit published The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
CVE-2016-0729 Critical 2016-04-07 Not applicable No public exploit Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.
CVE-2015-6937 Medium 2015-10-19 Not applicable No public exploit The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound.
CVE-2015-0235 High 2015-01-28 Outside Waratek scope Working exploit published Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
‹ prev page 3 of 3 next ›