CVE-2014-0422 Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors rela...
HighCVSS 10.0
EPSS 6.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to missing package access checks in the Naming / JNDI component, which allows attackers to escape the sandbox.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle jdk | = 1.5.0-update55 | No fix listed |
| oracle jdk | = 1.6.0-update65 | No fix listed |
| oracle jre | = 1.5.0-update55 | No fix listed |
| oracle jre | = 1.6.0-update65 | No fix listed |
| oracle jre | = 1.7.0-update45 | No fix listed |
References
- SUSE-SU-2014:0246 vendor-advisory
- SUSE-SU-2014:0266 vendor-advisory
- SUSE-SU-2014:0451 vendor-advisory
- openSUSE-SU-2014:0174 vendor-advisory
- openSUSE-SU-2014:0177 vendor-advisory
- openSUSE-SU-2014:0180 vendor-advisory
- SSRT101454 vendor-advisory
- SSRT101455 vendor-advisory
- 101997 vdb-entry
- RHSA-2014:0026 vendor-advisory
- RHSA-2014:0027 vendor-advisory
- RHSA-2014:0030 vendor-advisory
- RHSA-2014:0097 vendor-advisory
- RHSA-2014:0134 vendor-advisory
- RHSA-2014:0135 vendor-advisory
- RHSA-2014:0136 vendor-advisory
- 56432 third-party-advisory
- 56485 third-party-advisory
- 56486 third-party-advisory
- 56535 third-party-advisory
- www.oracle.com vendor-advisory
- 64758 vdb-entry
- 64921 vdb-entry
- 1029608 vdb-entry
- USN-2089-1 vendor-advisory
- USN-2124-1 vendor-advisory
- RHSA-2014:0414 vendor-advisory
- bugzilla.redhat.com
- h20566.www2.hpe.com