CVE-2018-11055

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-31 · updated 2026-06-17
Weakness: CWE-404

Description

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability. Decoded PKCS #12 data in heap memory is not zeroized by MES before releasing the memory internally and a malicious local user could gain access to the unauthorized data by doing heap inspection.

Affected products

Dell Bsafe: from 4.0.0 before 4.0.11; from 4.1.0 before 4.1.6.1 — fixed in 4.0.11, 4.1.6.1
Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
Oracle Communications Analytics: 12.1.1
Oracle Communications Ip Service Activator: 7.3.0, 7.4.0
Oracle Core Rdbms: 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
Oracle Corporation Enterprise Manager Ops Center: 12.3.3, 12.4.0
Oracle Goldengate Application Adapters: 12.3.2.1.0
Oracle Corporation JD Edwards EnterpriseOne Tools: 9.2
Oracle Real User Experience Insight: 13.1.2.1, 13.2.3.1, 13.3.1.0
Oracle Retail Predictive Application Server: 15.0.3, 16.0.3.0
Oracle Corporation Security Service: 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0
Oracle Corporation TimesTen In-Memory Database: before 18.1.4.1.0 — fixed in 18.1.4.1.0

How to fix

Upgrade to a fixed version: Dell Bsafe 4.0.11, 4.1.6.1; Oracle Corporation TimesTen In-Memory Database 18.1.4.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-11055 or the next vulnerability affects your stack