CVE catalog
CVE-2018-14335
UBUNTU-CVE-2018-14335
- Severity
- Medium · CVSS 4.3
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 13.22% · Oct 27, 2026
An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | h2database | pro | 1.4.185-1 | vulnerable |
| Ubuntu | h2database | pro | 1.4.185-2 | vulnerable |
| Ubuntu | h2database | pro | 1.4.190-1 | vulnerable |
| Ubuntu | h2database | pro | 1.4.191-1 | vulnerable |
| Ubuntu | h2database | pro | 1.4.191-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | h2database | pro | 1.4.196-1 | vulnerable |
| Ubuntu | h2database | pro | 1.4.196-2 | vulnerable |
| Ubuntu | h2database | pro | 1.4.196-2ubuntu0.1~esm1 | vulnerable |
| Ubuntu | h2database | 20.04 | 1.4.197-4 | vulnerable |
| Ubuntu | h2database | 20.04 | 1.4.197-4+deb10u1build0.20.04.1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: