var-201404-0374
Vulnerability from variot
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security. Java SE (Java Platform Standard Edition) is used to develop and deploy Java applications on desktops, servers, and embedded devices and real-time environments; JRockit is a Java virtual machine built into Oracle Fusion Middleware; Java SE Embedded is a The Java platform for developing powerful, reliable, and portable applications for embedded systems. Affects the confidentiality and integrity of data. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Critical: java-1.7.0-openjdk security update Advisory ID: RHSA-2014:0406-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0406.html Issue date: 2014-04-16 CVE Names: CVE-2014-0429 CVE-2014-0446 CVE-2014-0451 CVE-2014-0452 CVE-2014-0453 CVE-2014-0454 CVE-2014-0455 CVE-2014-0456 CVE-2014-0457 CVE-2014-0458 CVE-2014-0459 CVE-2014-0460 CVE-2014-0461 CVE-2014-1876 CVE-2014-2397 CVE-2014-2398 CVE-2014-2402 CVE-2014-2403 CVE-2014-2412 CVE-2014-2413 CVE-2014-2414 CVE-2014-2421 CVE-2014-2423 CVE-2014-2427 =====================================================================
- Summary:
Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
- Description:
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.
An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2014-0429)
Multiple flaws were discovered in the Hotspot and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to trigger Java Virtual Machine memory corruption and possibly bypass Java sandbox restrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421)
Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0457, CVE-2014-0455, CVE-2014-0461)
Multiple improper permission check issues were discovered in the AWT, JAX-WS, JAXB, Libraries, Security, Sound, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-2412, CVE-2014-0451, CVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-2402, CVE-2014-0446, CVE-2014-2413, CVE-2014-0454, CVE-2014-2427, CVE-2014-0459)
Multiple flaws were identified in the Java Naming and Directory Interface (JNDI) DNS client. These flaws could make it easier for a remote attacker to perform DNS spoofing attacks. (CVE-2014-0460)
It was discovered that the JAXP component did not properly prevent access to arbitrary files when a SecurityManager was present. This flaw could cause a Java application using JAXP to leak sensitive information, or affect application availability. (CVE-2014-2403)
It was discovered that the Security component in OpenJDK could leak some timing information when performing PKCS#1 unpadding. This could possibly lead to the disclosure of some information that was meant to be protected by encryption. (CVE-2014-0453)
It was discovered that the fix for CVE-2013-5797 did not properly resolve input sanitization flaws in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting (XSS) attacks. (CVE-2014-2398)
An insecure temporary file use flaw was found in the way the unpack200 utility created log files. A local attacker could possibly use this flaw to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running unpack200. (CVE-2014-1876)
Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.
All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.
- Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
1060907 - CVE-2014-1876 OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618) 1086632 - CVE-2014-2398 OpenJDK: insufficient escaping of window title string (Javadoc, 8026736) 1086645 - CVE-2014-0453 OpenJDK: RSA unpadding timing issues (Security, 8027766) 1087409 - CVE-2014-0429 OpenJDK: Incorrect mlib/raster image validation (2D, 8027841) 1087411 - CVE-2014-0457 OpenJDK: ServiceLoader Exception handling security bypass (Libraries, 8031394) 1087413 - CVE-2014-0456 OpenJDK: System.arraycopy() element race condition (Hotspot, 8029858) 1087417 - CVE-2014-2421 OpenJDK: JPEG decoder input stream handling (2D, 8029854) 1087423 - CVE-2014-2397 OpenJDK: classfile parser invalid BootstrapMethods attribute length (Hotspot, 8034926) 1087424 - CVE-2014-0455 OpenJDK: MethodHandle variable argument lists handling (Libraries, 8029844) 1087426 - CVE-2014-0461 OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794) 1087427 - CVE-2014-2412 OpenJDK: AWT thread context handling (AWT, 8025010) 1087428 - CVE-2014-0451 OpenJDK: AWT incorrect FlavorMap seperation (AWT, 8026797) 1087430 - CVE-2014-0458 OpenJDK: Activation framework default command map caching (JAX-WS, 8025152) 1087431 - CVE-2014-2414 OpenJDK: incorrect caching of data initialized via TCCL (JAXB, 8025030) 1087434 - CVE-2014-2423 OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026188) 1087436 - CVE-2014-0452 OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026801) 1087438 - CVE-2014-2402 OpenJDK: Incorrect NIO channel separation (Libraries, 8026716) 1087439 - CVE-2014-0446 OpenJDK: Protect logger handlers (Libraries, 8029740) 1087440 - CVE-2014-0454 OpenJDK: Prevent SIGNATURE_PRIMITIVE_SET from being modified (Security, 8029745) 1087441 - CVE-2014-2427 OpenJDK: remove insecure Java Sound provider caching (Sound, 8026163) 1087442 - CVE-2014-0460 OpenJDK: missing randomization of JNDI DNS client query IDs (JNDI, 8030731) 1087443 - CVE-2014-2403 OpenJDK: JAXP CharInfo file access restriction (JAXP, 8029282) 1087444 - CVE-2014-0459 lcms: insufficient ICC profile version validation (OpenJDK 2D, 8031335) 1087446 - CVE-2014-2413 OpenJDK: method handle call hierachy bypass (Libraries, 8032686)
- Package List:
Red Hat Enterprise Linux Desktop (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm
i386: java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm
x86_64: java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm
i386: java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.i686.rpm
noarch: java-1.7.0-openjdk-javadoc-1.7.0.55-2.4.7.1.el6_5.noarch.rpm
x86_64: java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm
x86_64: java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm
noarch: java-1.7.0-openjdk-javadoc-1.7.0.55-2.4.7.1.el6_5.noarch.rpm
x86_64: java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm
i386: java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.i686.rpm
noarch: java-1.7.0-openjdk-javadoc-1.7.0.55-2.4.7.1.el6_5.noarch.rpm
x86_64: java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm
i386: java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.i686.rpm
x86_64: java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm
i386: java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.i686.rpm
noarch: java-1.7.0-openjdk-javadoc-1.7.0.55-2.4.7.1.el6_5.noarch.rpm
x86_64: java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm
i386: java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.i686.rpm java-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.i686.rpm
x86_64: java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package
- References:
https://www.redhat.com/security/data/cve/CVE-2014-0429.html https://www.redhat.com/security/data/cve/CVE-2014-0446.html https://www.redhat.com/security/data/cve/CVE-2014-0451.html https://www.redhat.com/security/data/cve/CVE-2014-0452.html https://www.redhat.com/security/data/cve/CVE-2014-0453.html https://www.redhat.com/security/data/cve/CVE-2014-0454.html https://www.redhat.com/security/data/cve/CVE-2014-0455.html https://www.redhat.com/security/data/cve/CVE-2014-0456.html https://www.redhat.com/security/data/cve/CVE-2014-0457.html https://www.redhat.com/security/data/cve/CVE-2014-0458.html https://www.redhat.com/security/data/cve/CVE-2014-0459.html https://www.redhat.com/security/data/cve/CVE-2014-0460.html https://www.redhat.com/security/data/cve/CVE-2014-0461.html https://www.redhat.com/security/data/cve/CVE-2014-1876.html https://www.redhat.com/security/data/cve/CVE-2014-2397.html https://www.redhat.com/security/data/cve/CVE-2014-2398.html https://www.redhat.com/security/data/cve/CVE-2014-2402.html https://www.redhat.com/security/data/cve/CVE-2014-2403.html https://www.redhat.com/security/data/cve/CVE-2014-2412.html https://www.redhat.com/security/data/cve/CVE-2014-2413.html https://www.redhat.com/security/data/cve/CVE-2014-2414.html https://www.redhat.com/security/data/cve/CVE-2014-2421.html https://www.redhat.com/security/data/cve/CVE-2014-2423.html https://www.redhat.com/security/data/cve/CVE-2014-2427.html https://access.redhat.com/security/updates/classification/#critical
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFTTmzQXlSAg2UNWIIRAtKdAKCBGCXcmdsIke6rE6wALE8rmyh8PgCfVt/K i9yLmC1ovZP+Sr9z+PQskyk= =avQw -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201502-12
http://security.gentoo.org/
Severity: Normal Title: Oracle JRE/JDK: Multiple vulnerabilities Date: February 15, 2015 Bugs: #507798, #508716, #517220, #525464 ID: 201502-12
Synopsis
Multiple vulnerabilities have been found in Oracle's Java SE Development Kit and Runtime Environment, the worst of which could lead to execution of arbitrary code. Please review the CVE identifiers referenced below for details.
Impact
A context-dependent attacker may be able to execute arbitrary code, disclose, update, insert, or delete certain data.
Workaround
There is no known workaround at this time.
Resolution
All Oracle JRE 1.7 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=dev-java/oracle-jre-bin-1.7.0.71"
All Oracle JDK 1.7 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=dev-java/oracle-jdk-bin-1.7.0.71"
All users of the precompiled 32-bit Oracle JRE should upgrade to the latest version:
# emerge --sync # emerge -a -1 -v ">=app-emulation/emul-linux-x86-java-1.7.0.71"
References
[ 1 ] CVE-2014-0429 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0429 [ 2 ] CVE-2014-0432 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0432 [ 3 ] CVE-2014-0446 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0446 [ 4 ] CVE-2014-0448 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0448 [ 5 ] CVE-2014-0449 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0449 [ 6 ] CVE-2014-0451 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0451 [ 7 ] CVE-2014-0452 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0452 [ 8 ] CVE-2014-0453 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0453 [ 9 ] CVE-2014-0454 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0454 [ 10 ] CVE-2014-0455 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0455 [ 11 ] CVE-2014-0456 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0456 [ 12 ] CVE-2014-0457 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0457 [ 13 ] CVE-2014-0458 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0458 [ 14 ] CVE-2014-0459 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0459 [ 15 ] CVE-2014-0460 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0460 [ 16 ] CVE-2014-0461 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0461 [ 17 ] CVE-2014-0463 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0463 [ 18 ] CVE-2014-0464 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0464 [ 19 ] CVE-2014-2397 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2397 [ 20 ] CVE-2014-2398 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2398 [ 21 ] CVE-2014-2401 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2401 [ 22 ] CVE-2014-2402 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2402 [ 23 ] CVE-2014-2403 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2403 [ 24 ] CVE-2014-2409 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2409 [ 25 ] CVE-2014-2410 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2410 [ 26 ] CVE-2014-2412 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2412 [ 27 ] CVE-2014-2413 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2413 [ 28 ] CVE-2014-2414 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2414 [ 29 ] CVE-2014-2420 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2420 [ 30 ] CVE-2014-2421 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2421 [ 31 ] CVE-2014-2422 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2422 [ 32 ] CVE-2014-2423 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2423 [ 33 ] CVE-2014-2427 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2427 [ 34 ] CVE-2014-2428 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2428 [ 35 ] CVE-2014-2483 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2483 [ 36 ] CVE-2014-2490 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2490 [ 37 ] CVE-2014-4208 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4208 [ 38 ] CVE-2014-4209 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4209 [ 39 ] CVE-2014-4216 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4216 [ 40 ] CVE-2014-4218 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4218 [ 41 ] CVE-2014-4219 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4219 [ 42 ] CVE-2014-4220 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4220 [ 43 ] CVE-2014-4221 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4221 [ 44 ] CVE-2014-4223 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4223 [ 45 ] CVE-2014-4227 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4227 [ 46 ] CVE-2014-4244 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4244 [ 47 ] CVE-2014-4247 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4247 [ 48 ] CVE-2014-4252 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4252 [ 49 ] CVE-2014-4262 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4262 [ 50 ] CVE-2014-4263 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4263 [ 51 ] CVE-2014-4264 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4264 [ 52 ] CVE-2014-4265 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4265 [ 53 ] CVE-2014-4266 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4266 [ 54 ] CVE-2014-4268 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4268 [ 55 ] CVE-2014-4288 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4288 [ 56 ] CVE-2014-6456 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6456 [ 57 ] CVE-2014-6457 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6457 [ 58 ] CVE-2014-6458 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6458 [ 59 ] CVE-2014-6466 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6466 [ 60 ] CVE-2014-6468 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6468 [ 61 ] CVE-2014-6476 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6476 [ 62 ] CVE-2014-6485 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6485 [ 63 ] CVE-2014-6492 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6492 [ 64 ] CVE-2014-6493 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6493 [ 65 ] CVE-2014-6502 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6502 [ 66 ] CVE-2014-6503 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6503 [ 67 ] CVE-2014-6504 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6504 [ 68 ] CVE-2014-6506 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6506 [ 69 ] CVE-2014-6511 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6511 [ 70 ] CVE-2014-6512 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6512 [ 71 ] CVE-2014-6513 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6513 [ 72 ] CVE-2014-6515 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6515 [ 73 ] CVE-2014-6517 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6517 [ 74 ] CVE-2014-6519 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6519 [ 75 ] CVE-2014-6527 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6527 [ 76 ] CVE-2014-6531 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6531 [ 77 ] CVE-2014-6532 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6532 [ 78 ] CVE-2014-6558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6558 [ 79 ] CVE-2014-6562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6562
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201502-12.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 . In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets. Bugs fixed (https://bugzilla.redhat.com/):
1031734 - CVE-2013-6629 libjpeg: information leak (read of uninitialized memory) 1045561 - CVE-2013-6954 libpng: unhandled zero-length PLTE chunk or NULL palette 1051519 - CVE-2014-0428 OpenJDK: insufficient security checks in IIOP streams (CORBA, 8025767) 1051528 - CVE-2014-0422 OpenJDK: insufficient package access checks in the Naming component (JNDI, 8025758) 1051699 - CVE-2014-0373 OpenJDK: SnmpStatusException handling issues (Serviceability, 7068126) 1051823 - CVE-2013-5878 OpenJDK: null xmlns handling issue (Security, 8025026) 1051911 - CVE-2013-5884 OpenJDK: insufficient security checks in CORBA stub factories (CORBA, 8026193) 1051912 - CVE-2014-0416 OpenJDK: insecure subject principals set handling (JAAS, 8024306) 1051923 - CVE-2014-0376 OpenJDK: document builder missing security checks (JAXP, 8027201, 8025018) 1052915 - CVE-2013-5907 ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034) 1052919 - CVE-2014-0368 OpenJDK: insufficient Socket checkListen checks (Networking, 8011786) 1052942 - CVE-2013-5910 OpenJDK: XML canonicalizer mutable strings passed to untrusted code (Security, 8026417) 1053010 - CVE-2014-0411 OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069) 1053066 - CVE-2014-0423 OpenJDK: XXE issue in decoder (Beans, 8023245) 1053266 - CVE-2013-5896 OpenJDK: com.sun.corba.se.
Release Date: 2014-08-19 Last Updated: 2014-08-19
Potential Security Impact: Remote unauthorized access, disclosure of information, and other vulnerabilities
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY Potential security vulnerabilities have been identified in Java Runtime Environment (JRE) and Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities.
References:
CVE-2013-6629
CVE-2013-6954
CVE-2014-0432
CVE-2014-0446
CVE-2014-0448
CVE-2014-0449
CVE-2014-0451
CVE-2014-0452
CVE-2014-0453
CVE-2014-0454
CVE-2014-0455
CVE-2014-0456
CVE-2014-0458
CVE-2014-0459
CVE-2014-0460
CVE-2014-0461
CVE-2014-1876
CVE-2014-2397
CVE-2014-2398
CVE-2014-2401
CVE-2014-2402
CVE-2014-2403
CVE-2014-2409
CVE-2014-2412
CVE-2014-2413
CVE-2014-2414
CVE-2014-2420
CVE-2014-2421
CVE-2014-2422
CVE-2014-2423
CVE-2014-2427
CVE-2014-2428
CVE-2014-2483
CVE-2014-2490
CVE-2014-4208
CVE-2014-4209
CVE-2014-4216
CVE-2014-4218
CVE-2014-4220
CVE-2014-4221
CVE-2014-4223
CVE-2014-4244
CVE-2014-4252
CVE-2014-4262
CVE-2014-4263
CVE-2014-4264
CVE-2014-4265
CVE-2014-4266
CVE-2014-4268
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.23, and B.11.31 running HP JDK and JRE v7.0.09 and earlier.
BACKGROUND
CVSS 2.0 Base Metrics
Reference Base Vector Base Score CVE-2013-6629 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 CVE-2013-6954 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2014-0432 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2014-0446 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2014-0448 (AV:N/AC:H/Au:N/C:C/I:C/A:C) 7.6 CVE-2014-0449 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 CVE-2014-0451 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2014-0452 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2014-0453 (AV:N/AC:H/Au:N/C:P/I:P/A:N) 4.0 CVE-2014-0454 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2014-0455 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2014-0456 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2014-0458 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2014-0459 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3 CVE-2014-0460 (AV:N/AC:M/Au:N/C:P/I:P/A:N) 5.8 CVE-2014-0461 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2014-1876 (AV:L/AC:M/Au:N/C:P/I:P/A:P) 4.4 CVE-2014-2397 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2014-2398 (AV:N/AC:M/Au:S/C:N/I:P/A:N) 3.5 CVE-2014-2401 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0 CVE-2014-2402 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2014-2403 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 CVE-2014-2409 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4 CVE-2014-2412 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2014-2413 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2014-2414 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2014-2420 (AV:N/AC:H/Au:N/C:N/I:P/A:N) 2.6 CVE-2014-2421 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2014-2422 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8 CVE-2014-2423 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2014-2427 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2014-2428 (AV:N/AC:H/Au:N/C:C/I:C/A:C) 7.6 CVE-2014-2483 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2014-2490 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2014-4208 (AV:N/AC:H/Au:N/C:N/I:P/A:N) 2.6 CVE-2014-4209 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4 CVE-2014-4216 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2014-4218 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0 CVE-2014-4220 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0 CVE-2014-4221 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2014-4223 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2014-4244 (AV:N/AC:H/Au:N/C:P/I:P/A:N) 4.0 CVE-2014-4252 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 CVE-2014-4262 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2014-4263 (AV:N/AC:H/Au:N/C:P/I:P/A:N) 4.0 CVE-2014-4264 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2014-4265 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0 CVE-2014-4266 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0 CVE-2014-4268 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has provided the following Java version upgrade to resolve these vulnerabilities.
The upgrade is available from the following location: http://www.hp.com/java
OS Version Release Version Depot Name
HP-UX B.11.23, B.11.31 JDK and JRE v7.0.10 or subsequent Itanium_JDK_JRE_7.0.10_Aug_2014_Java70_1.7.0.10.00_HP-UX_B.11.31_IA.depot
MANUAL ACTIONS: Yes - Update For Java v7.0 update to Java v7.0.10 or subsequent
PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS
HP-UX B.11.23 HP-UX B.11.31 =========== Jdk70.JDK70-COM Jdk70.JDK70-DEMO Jdk70.JDK70-IPF32 Jdk70.JDK70-IPF64 Jre70.JRE70-COM Jre70.JRE70-IPF32 Jre70.JRE70-IPF32-HS Jre70.JRE70-IPF64 Jre70.JRE70-IPF64-HS action: install revision 1.7.0.10.00 or subsequent
END AFFECTED VERSIONS
HISTORY Version:1 (rev.1) - 19 August 2014 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX
Copyright 2014 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
Note that the CVE-2014-0459 issue is in the lcms2 library, which has been patched to correct this flaw. The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFTdfckmqjQ0CJFipgRArKEAKCIiAR2WkLo3Vb0gzzQ5RDz7hQZ3gCcDC6A 5xOtKkhOvonpLXoqBiAcXWQ= =qBk5 -----END PGP SIGNATURE----- .
For the oldstable distribution (squeeze), these problems have been fixed in version 6b31-1.13.3-1~deb6u1.
For the stable distribution (wheezy), these problems have been fixed in version 6b31-1.13.3-1~deb7u1.
For the testing distribution (jessie), these problems have been fixed in version 6b31-1.13.3-1.
For the unstable distribution (sid), these problems have been fixed in version 6b31-1.13.3-1
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201404-0374", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "jrockit", scope: "eq", trust: 2.4, vendor: "oracle", version: "r28.3.1", }, { model: "jrockit", scope: "eq", trust: 1.8, vendor: "oracle", version: "r27.8.1", }, { model: "ubuntu linux", scope: "eq", trust: 1, vendor: "canonical", version: "12.04", }, { model: "forms viewer", scope: "gte", trust: 1, vendor: "ibm", version: "4.0.0", }, { model: "ubuntu linux", scope: "eq", trust: 1, vendor: "canonical", version: "13.10", }, { model: "jre", scope: "eq", trust: 1, vendor: "oracle", version: "1.7.0", }, { model: "linux", scope: "eq", trust: 1, vendor: "debian", version: "6.0", }, { model: "forms viewer", scope: "lt", trust: 1, vendor: "ibm", version: "4.0.0.3", }, { model: "forms viewer", scope: "lt", trust: 1, vendor: "ibm", version: "8.0.1.1", }, { model: "jre", scope: "eq", trust: 1, vendor: "oracle", version: "1.6.0", }, { model: "jdk", scope: "eq", trust: 1, vendor: "oracle", version: "1.7.0", }, { model: "linux", scope: "eq", trust: 1, vendor: "debian", version: "7.0", }, { model: "jdk", scope: "eq", trust: 1, vendor: "oracle", version: "1.6.0", }, { model: "jre", scope: "eq", trust: 1, vendor: "oracle", version: "1.5.0", }, { model: "jre", scope: "eq", trust: 1, vendor: "oracle", version: "1.8.0", }, { model: "ubuntu linux", scope: "eq", trust: 1, vendor: "canonical", version: "14.04", }, { model: "forms viewer", scope: "gte", trust: 1, vendor: "ibm", version: "8.0.0", }, { model: "junos space", scope: "lt", trust: 1, vendor: "juniper", version: "15.1", }, { model: "jdk", scope: "eq", trust: 1, vendor: "oracle", version: "1.5.0", }, { model: "jdk", scope: "eq", trust: 1, vendor: "oracle", version: "1.8.0", }, { model: "ubuntu linux", scope: "eq", trust: 1, vendor: "canonical", version: "12.10", }, { model: "linux", scope: "eq", trust: 1, vendor: "debian", version: "8.0", }, { model: "ubuntu linux", scope: "eq", trust: 1, vendor: "canonical", version: "10.04", }, { model: "api management", scope: "eq", trust: 0.8, vendor: "ibm", version: "2.0.0.0", }, { model: "api management", scope: "eq", trust: 0.8, vendor: "ibm", version: "2.0.0.1", }, { model: "api management", scope: "eq", trust: 0.8, vendor: "ibm", version: "2.0.0.2", }, { model: "api management", scope: "eq", trust: 0.8, vendor: "ibm", version: "3.0.0.0", }, { model: "domino", scope: "lte", trust: 0.8, vendor: "ibm", version: "8.5.3 fix pack 6", }, { model: "domino", scope: "lte", trust: 0.8, vendor: "ibm", version: "9.0.1 fix pack 1", }, { model: "fabric manager", scope: "lte", trust: 0.8, vendor: "ibm", version: "4.1.00.22", }, { model: "financial transaction manager", scope: "eq", trust: 0.8, vendor: "ibm", version: "for ach services 2.1.1.0", }, { model: "financial transaction manager", scope: "eq", trust: 0.8, vendor: "ibm", version: "for check services 2.1.1.2", }, { model: "financial transaction manager", scope: "eq", trust: 0.8, vendor: "ibm", version: "for check services 2.1.1.5", }, { model: "financial transaction manager", scope: "eq", trust: 0.8, vendor: "ibm", version: "for corporate payment services 2.1.1.0", }, { model: "ims enterprise suite", scope: "eq", trust: 0.8, vendor: "ibm", version: "of soap gateway 2.1", }, { model: "ims enterprise suite", scope: "eq", trust: 0.8, vendor: "ibm", version: "of soap gateway 2.2", }, { model: "ims enterprise suite", scope: "eq", trust: 0.8, vendor: "ibm", version: "of soap gateway 3.1", }, { model: "infosphere data replication", scope: "eq", trust: 0.8, vendor: "ibm", version: "dashboard 10.1", }, { model: "infosphere data replication", scope: "eq", trust: 0.8, vendor: "ibm", version: "dashboard 10.2", }, { model: "infosphere data replication", scope: "eq", trust: 0.8, vendor: "ibm", version: "dashboard 10.2.1", }, { model: "infosphere data replication", scope: "eq", trust: 0.8, vendor: "ibm", version: "dashboard 9.7", }, { model: "infosphere streams", scope: "eq", trust: 0.8, vendor: "ibm", version: "1.0.1", }, { model: "infosphere streams", scope: "eq", trust: 0.8, vendor: "ibm", version: "3.2.1", }, { model: "infosphere streams", scope: "eq", trust: 0.8, vendor: "ibm", version: "version 1.0", }, { model: "infosphere streams", scope: "eq", trust: 0.8, vendor: "ibm", version: "version 2.0", }, { model: "infosphere streams", scope: "eq", trust: 0.8, vendor: "ibm", version: "version 3.0", }, { model: "infosphere streams", scope: "eq", trust: 0.8, vendor: "ibm", version: "version 3.1", }, { model: "infosphere streams", scope: "eq", trust: 0.8, vendor: "ibm", version: "version 3.2", }, { model: "lotus quickr", scope: "eq", trust: 0.8, vendor: "ibm", version: "8.5 for websphere portal", }, { model: "multi-enterprise integration gateway", scope: "eq", trust: 0.8, vendor: "ibm", version: "1.0", }, { model: "notes", scope: "lte", trust: 0.8, vendor: "ibm", version: "8.5.3 fix pack 6", }, { model: "notes", scope: "lte", trust: 0.8, vendor: "ibm", version: "9.0.1 fix pack 1", }, { model: "operational decision manager", scope: "eq", trust: 0.8, vendor: "ibm", version: "8.0", }, { model: "operational decision manager", scope: "eq", trust: 0.8, vendor: "ibm", version: "8.5", }, { model: "operational decision manager", scope: "eq", trust: 0.8, vendor: "ibm", version: "8.6", }, { model: "security access manager for mobile the appliance", scope: null, trust: 0.8, vendor: "ibm", version: null, }, { model: "security access manager for mobile software", scope: "eq", trust: 0.8, vendor: "ibm", version: "8.0", }, { model: "security access manager for web the appliance", scope: null, trust: 0.8, vendor: "ibm", version: null, }, { model: "security access manager for web software", scope: "eq", trust: 0.8, vendor: "ibm", version: "7.0", }, { model: "security access manager for web software", scope: "eq", trust: 0.8, vendor: "ibm", version: "8.0", }, { model: "smartcloud provisioning", scope: "eq", trust: 0.8, vendor: "ibm", version: "1.2", }, { model: "smartcloud provisioning", scope: "eq", trust: 0.8, vendor: "ibm", version: "2.1 to 2.1 fix pack 4", }, { model: "smartcloud provisioning", scope: "eq", trust: 0.8, vendor: "ibm", version: "2.3", }, { model: "smartcloud provisioning", scope: "eq", trust: 0.8, vendor: "ibm", version: "2.3 fix pack 1", }, { model: "websphere business events", scope: "eq", trust: 0.8, vendor: "ibm", version: "7.0", }, { model: "websphere ilog jrules", scope: "eq", trust: 0.8, vendor: "ibm", version: "7.0", }, { model: "websphere ilog jrules", scope: "eq", trust: 0.8, vendor: "ibm", version: "7.1", }, { model: "websphere operational decision management", scope: "eq", trust: 0.8, vendor: "ibm", version: "7.5", }, { model: "rational connector for sap solution manager", scope: "eq", trust: 0.8, vendor: "ibm", version: "4.0.0.x", }, { model: "websphere cast iron", scope: "eq", trust: 0.8, vendor: "ibm", version: "6.0 (studio)", }, { model: "websphere cast iron", scope: "eq", trust: 0.8, vendor: "ibm", version: "6.1 (studio)", }, { model: "websphere cast iron", scope: "eq", trust: 0.8, vendor: "ibm", version: "6.3 (studio)", }, { model: "websphere cast iron", scope: "eq", trust: 0.8, vendor: "ibm", version: "6.4 (studio)", }, { model: "websphere cast iron", scope: "eq", trust: 0.8, vendor: "ibm", version: "7.0 (studio)", }, { model: "websphere cast iron", scope: "eq", trust: 0.8, vendor: "ibm", version: "live 6.3 (saas offering)", }, { model: "websphere cast iron", scope: "eq", trust: 0.8, vendor: "ibm", version: "live 7.0 (saas offering)", }, { model: "websphere cast iron cloud integration virtual appliance", scope: null, trust: 0.8, vendor: "ibm", version: null, }, { model: "websphere cast iron cloud integration physical appliance", scope: null, trust: 0.8, vendor: "ibm", version: null, }, { model: "jdk", scope: "eq", trust: 0.8, vendor: "oracle", version: "5.0 update 61", }, { model: "jdk", scope: "eq", trust: 0.8, vendor: "oracle", version: "6 update 71", }, { model: "jdk", scope: "eq", trust: 0.8, vendor: "oracle", version: "7 update 51", }, { model: "jdk", scope: "eq", trust: 0.8, vendor: "oracle", version: "8", }, { model: "jre", scope: "eq", trust: 0.8, vendor: "oracle", version: "5.0 update 61", }, { model: "jre", scope: "eq", trust: 0.8, vendor: "oracle", version: "6 update 71", }, { model: "jre", scope: "eq", trust: 0.8, vendor: "oracle", version: "7 update 51", }, { model: "jre", scope: "eq", trust: 0.8, vendor: "oracle", version: "8", }, { model: "java se", scope: "eq", trust: 0.8, vendor: "oracle", version: "embedded 7 update 51", }, { model: "cosminexus application server enterprise", scope: "eq", trust: 0.8, vendor: "hitachi", version: "version 6", }, { model: "cosminexus application server standard", scope: "eq", trust: 0.8, vendor: "hitachi", version: "version 6", }, { model: "cosminexus application server version 5", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "cosminexus client", scope: "eq", trust: 0.8, vendor: "hitachi", version: "version 6", }, { model: "cosminexus developer light version 6", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "cosminexus developer professional version 6", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "cosminexus developer standard version 6", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "cosminexus developer version 5", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "cosminexus developer's kit for java", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "cosminexus primary server", scope: "eq", trust: 0.8, vendor: "hitachi", version: "base", }, { model: "cosminexus studio", scope: "eq", trust: 0.8, vendor: "hitachi", version: "version 5", }, { model: "ucosminexus application server", scope: "eq", trust: 0.8, vendor: "hitachi", version: "-r", }, { model: "ucosminexus application server", scope: "eq", trust: 0.8, vendor: "hitachi", version: "express", }, { model: "ucosminexus application server", scope: "eq", trust: 0.8, vendor: "hitachi", version: "light", }, { model: "ucosminexus application server", scope: "eq", trust: 0.8, vendor: "hitachi", version: "standard-r", }, { model: "ucosminexus application server enterprise", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "ucosminexus application server smart edition", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "ucosminexus application server standard", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "ucosminexus client", scope: "eq", trust: 0.8, vendor: "hitachi", version: "none", }, { model: "ucosminexus client", scope: "eq", trust: 0.8, vendor: "hitachi", version: "for plug-in", }, { model: "ucosminexus developer", scope: "eq", trust: 0.8, vendor: "hitachi", version: "01", }, { model: "ucosminexus developer", scope: "eq", trust: 0.8, vendor: "hitachi", version: "professional", }, { model: "ucosminexus developer", scope: "eq", trust: 0.8, vendor: "hitachi", version: "professional for plug-in", }, { model: "ucosminexus developer light", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "ucosminexus developer standard", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "ucosminexus operator", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "ucosminexus primary server", scope: "eq", trust: 0.8, vendor: "hitachi", version: "base", }, { model: "ucosminexus server", scope: "eq", trust: 0.8, vendor: "hitachi", version: "standard-r", }, { model: "ucosminexus service architect", scope: null, trust: 0.8, vendor: "hitachi", version: null, }, { model: "ucosminexus service platform", scope: "eq", trust: 0.8, vendor: "hitachi", version: "none", }, { model: "ucosminexus service platform", scope: "eq", trust: 0.8, vendor: "hitachi", version: "- messaging", }, ], sources: [ { db: "JVNDB", id: "JVNDB-2014-002089", }, { db: "CNNVD", id: "CNNVD-201404-268", }, { db: "NVD", id: "CVE-2014-0453", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { cpe_match: [ { cpe22Uri: "cpe:/a:ibm:api_management", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:lotus_domino", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:ibm_fabric_manager", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:financial_transaction_manager", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:ims_enterprise_suite", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:infosphere_data_replication", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:infosphere_streams", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:lotus_quickr", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:multi-enterprise_integration_gateway", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:notes", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:operational_decision_manager", vulnerable: true, }, { cpe22Uri: "cpe:/h:ibm:security_access_manager_for_mobile_appliance", vulnerable: true, }, { cpe22Uri: "cpe:/o:ibm:security_access_manager_for_mobile_software", vulnerable: true, }, { cpe22Uri: "cpe:/h:ibm:security_access_manager_for_web_appliance", vulnerable: true, }, { cpe22Uri: "cpe:/o:ibm:security_access_manager_for_web_software", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:smartcloud_provisioning", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:websphere_business_events", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:websphere_ilog_jrules", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:websphere_operational_decision_management", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:rational_connector_for_sap_solution_manager", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:webshere_cast_iron", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:webshere_cast_iron_cloud_integration", vulnerable: true, }, { cpe22Uri: "cpe:/h:ibm:webshere_cast_iron_cloud_integration", vulnerable: true, }, { cpe22Uri: "cpe:/a:oracle:jdk", vulnerable: true, }, { cpe22Uri: "cpe:/a:oracle:jre", vulnerable: true, }, { cpe22Uri: "cpe:/a:oracle:java_se", vulnerable: true, }, { cpe22Uri: "cpe:/a:oracle:jrockit", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_application_server_enterprise", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_application_server_standard", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_application_server_version_5", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_client", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_developer_light_version_6", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_developer_professional_version_6", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_developer_standard_version_6", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_developer_version_5", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_developers_kit_for_java", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_primary_server", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:cosminexus_studio", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_application_server", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_application_server_enterprise", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_application_server_smart_edition", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_application_server_standard", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_client", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_developer", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_developer_light", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_developer_standard", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_operator", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_primary_server", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_server", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_service_architect", vulnerable: true, }, { cpe22Uri: "cpe:/a:hitachi:ucosminexus_service_platform", vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "JVNDB", id: "JVNDB-2014-002089", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Red Hat", sources: [ { db: "PACKETSTORM", id: "126182", }, { db: "PACKETSTORM", id: "126200", }, { db: "PACKETSTORM", id: "127655", }, { db: "PACKETSTORM", id: "126631", }, ], trust: 0.4, }, cve: "CVE-2014-0453", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", author: "nvd@nist.gov", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", exploitabilityScore: 4.9, id: "CVE-2014-0453", impactScore: 4.9, integrityImpact: "PARTIAL", severity: "MEDIUM", trust: 1.9, vectorString: "AV:N/AC:H/Au:N/C:P/I:P/A:N", version: "2.0", }, { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", author: "VULHUB", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", exploitabilityScore: 4.9, id: "VHN-67946", impactScore: 4.9, integrityImpact: "PARTIAL", severity: "MEDIUM", trust: 0.1, vectorString: "AV:N/AC:H/AU:N/C:P/I:P/A:N", version: "2.0", }, ], cvssV3: [], severity: [ { author: "nvd@nist.gov", id: "CVE-2014-0453", trust: 1, value: "MEDIUM", }, { author: "NVD", id: "CVE-2014-0453", trust: 0.8, value: "Medium", }, { author: "CNNVD", id: "CNNVD-201404-268", trust: 0.6, value: "MEDIUM", }, { author: "VULHUB", id: "VHN-67946", trust: 0.1, value: "MEDIUM", }, { author: "VULMON", id: "CVE-2014-0453", trust: 0.1, value: "MEDIUM", }, ], }, ], sources: [ { db: "VULHUB", id: "VHN-67946", }, { db: "VULMON", id: "CVE-2014-0453", }, { db: "JVNDB", id: "JVNDB-2014-002089", }, { db: "CNNVD", id: "CNNVD-201404-268", }, { db: "NVD", id: "CVE-2014-0453", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security. Java SE (Java Platform Standard Edition) is used to develop and deploy Java applications on desktops, servers, and embedded devices and real-time environments; JRockit is a Java virtual machine built into Oracle Fusion Middleware; Java SE Embedded is a The Java platform for developing powerful, reliable, and portable applications for embedded systems. Affects the confidentiality and integrity of data. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Critical: java-1.7.0-openjdk security update\nAdvisory ID: RHSA-2014:0406-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2014-0406.html\nIssue date: 2014-04-16\nCVE Names: CVE-2014-0429 CVE-2014-0446 CVE-2014-0451 \n CVE-2014-0452 CVE-2014-0453 CVE-2014-0454 \n CVE-2014-0455 CVE-2014-0456 CVE-2014-0457 \n CVE-2014-0458 CVE-2014-0459 CVE-2014-0460 \n CVE-2014-0461 CVE-2014-1876 CVE-2014-2397 \n CVE-2014-2398 CVE-2014-2402 CVE-2014-2403 \n CVE-2014-2412 CVE-2014-2413 CVE-2014-2414 \n CVE-2014-2421 CVE-2014-2423 CVE-2014-2427 \n=====================================================================\n\n1. Summary:\n\nUpdated java-1.7.0-openjdk packages that fix various security issues are\nnow available for Red Hat Enterprise Linux 6. \n\nThe Red Hat Security Response Team has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Desktop (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64\nRed Hat Enterprise Linux HPC Node (v. 6) - x86_64\nRed Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64\nRed Hat Enterprise Linux Server (v. 6) - i386, noarch, x86_64\nRed Hat Enterprise Linux Server Optional (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64\n\n3. Description:\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit. \n\nAn input validation flaw was discovered in the medialib library in the 2D\ncomponent. A specially crafted image could trigger Java Virtual Machine\nmemory corruption when processed. A remote attacker, or an untrusted Java\napplication or applet, could possibly use this flaw to execute arbitrary\ncode with the privileges of the user running the Java Virtual Machine. \n(CVE-2014-0429)\n\nMultiple flaws were discovered in the Hotspot and 2D components in OpenJDK. \nAn untrusted Java application or applet could use these flaws to trigger\nJava Virtual Machine memory corruption and possibly bypass Java sandbox\nrestrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421)\n\nMultiple improper permission check issues were discovered in the Libraries\ncomponent in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass Java sandbox restrictions. (CVE-2014-0457,\nCVE-2014-0455, CVE-2014-0461)\n\nMultiple improper permission check issues were discovered in the AWT,\nJAX-WS, JAXB, Libraries, Security, Sound, and 2D components in OpenJDK. \nAn untrusted Java application or applet could use these flaws to bypass\ncertain Java sandbox restrictions. (CVE-2014-2412, CVE-2014-0451,\nCVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-2402,\nCVE-2014-0446, CVE-2014-2413, CVE-2014-0454, CVE-2014-2427, CVE-2014-0459)\n\nMultiple flaws were identified in the Java Naming and Directory Interface\n(JNDI) DNS client. These flaws could make it easier for a remote attacker\nto perform DNS spoofing attacks. (CVE-2014-0460)\n\nIt was discovered that the JAXP component did not properly prevent access\nto arbitrary files when a SecurityManager was present. This flaw could\ncause a Java application using JAXP to leak sensitive information, or\naffect application availability. (CVE-2014-2403)\n\nIt was discovered that the Security component in OpenJDK could leak some\ntiming information when performing PKCS#1 unpadding. This could possibly\nlead to the disclosure of some information that was meant to be protected\nby encryption. (CVE-2014-0453)\n\nIt was discovered that the fix for CVE-2013-5797 did not properly resolve\ninput sanitization flaws in javadoc. When javadoc documentation was\ngenerated from an untrusted Java source code and hosted on a domain not\ncontrolled by the code author, these issues could make it easier to perform\ncross-site scripting (XSS) attacks. (CVE-2014-2398)\n\nAn insecure temporary file use flaw was found in the way the unpack200\nutility created log files. A local attacker could possibly use this flaw to\nperform a symbolic link attack and overwrite arbitrary files with the\nprivileges of the user running unpack200. (CVE-2014-1876)\n\nNote: If the web browser plug-in provided by the icedtea-web package was\ninstalled, the issues exposed via Java applets could have been exploited\nwithout user interaction if a user visited a malicious website. \n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect. \n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1060907 - CVE-2014-1876 OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618)\n1086632 - CVE-2014-2398 OpenJDK: insufficient escaping of window title string (Javadoc, 8026736)\n1086645 - CVE-2014-0453 OpenJDK: RSA unpadding timing issues (Security, 8027766)\n1087409 - CVE-2014-0429 OpenJDK: Incorrect mlib/raster image validation (2D, 8027841)\n1087411 - CVE-2014-0457 OpenJDK: ServiceLoader Exception handling security bypass (Libraries, 8031394)\n1087413 - CVE-2014-0456 OpenJDK: System.arraycopy() element race condition (Hotspot, 8029858)\n1087417 - CVE-2014-2421 OpenJDK: JPEG decoder input stream handling (2D, 8029854)\n1087423 - CVE-2014-2397 OpenJDK: classfile parser invalid BootstrapMethods attribute length (Hotspot, 8034926)\n1087424 - CVE-2014-0455 OpenJDK: MethodHandle variable argument lists handling (Libraries, 8029844)\n1087426 - CVE-2014-0461 OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)\n1087427 - CVE-2014-2412 OpenJDK: AWT thread context handling (AWT, 8025010)\n1087428 - CVE-2014-0451 OpenJDK: AWT incorrect FlavorMap seperation (AWT, 8026797)\n1087430 - CVE-2014-0458 OpenJDK: Activation framework default command map caching (JAX-WS, 8025152)\n1087431 - CVE-2014-2414 OpenJDK: incorrect caching of data initialized via TCCL (JAXB, 8025030)\n1087434 - CVE-2014-2423 OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026188)\n1087436 - CVE-2014-0452 OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026801)\n1087438 - CVE-2014-2402 OpenJDK: Incorrect NIO channel separation (Libraries, 8026716)\n1087439 - CVE-2014-0446 OpenJDK: Protect logger handlers (Libraries, 8029740)\n1087440 - CVE-2014-0454 OpenJDK: Prevent SIGNATURE_PRIMITIVE_SET from being modified (Security, 8029745)\n1087441 - CVE-2014-2427 OpenJDK: remove insecure Java Sound provider caching (Sound, 8026163)\n1087442 - CVE-2014-0460 OpenJDK: missing randomization of JNDI DNS client query IDs (JNDI, 8030731)\n1087443 - CVE-2014-2403 OpenJDK: JAXP CharInfo file access restriction (JAXP, 8029282)\n1087444 - CVE-2014-0459 lcms: insufficient ICC profile version validation (OpenJDK 2D, 8031335)\n1087446 - CVE-2014-2413 OpenJDK: method handle call hierachy bypass (Libraries, 8032686)\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm\n\ni386:\njava-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm\n\nx86_64:\njava-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\n\nRed Hat Enterprise Linux Desktop Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm\n\ni386:\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.i686.rpm\n\nnoarch:\njava-1.7.0-openjdk-javadoc-1.7.0.55-2.4.7.1.el6_5.noarch.rpm\n\nx86_64:\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\n\nRed Hat Enterprise Linux HPC Node (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm\n\nx86_64:\njava-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\n\nRed Hat Enterprise Linux HPC Node Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm\n\nnoarch:\njava-1.7.0-openjdk-javadoc-1.7.0.55-2.4.7.1.el6_5.noarch.rpm\n\nx86_64:\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm\n\ni386:\njava-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.i686.rpm\n\nnoarch:\njava-1.7.0-openjdk-javadoc-1.7.0.55-2.4.7.1.el6_5.noarch.rpm\n\nx86_64:\njava-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm\n\ni386:\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.i686.rpm\n\nx86_64:\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm\n\ni386:\njava-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.i686.rpm\n\nnoarch:\njava-1.7.0-openjdk-javadoc-1.7.0.55-2.4.7.1.el6_5.noarch.rpm\n\nx86_64:\njava-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.src.rpm\n\ni386:\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.i686.rpm\njava-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.i686.rpm\n\nx86_64:\njava-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\njava-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2014-0429.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0446.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0451.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0452.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0453.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0454.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0455.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0456.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0457.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0458.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0459.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0460.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0461.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-1876.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-2397.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-2398.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-2402.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-2403.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-2412.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-2413.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-2414.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-2421.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-2423.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-2427.html\nhttps://access.redhat.com/security/updates/classification/#critical\n\n8. Contact:\n\nThe Red Hat security contact is <secalert@redhat.com>. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2014 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD8DBQFTTmzQXlSAg2UNWIIRAtKdAKCBGCXcmdsIke6rE6wALE8rmyh8PgCfVt/K\ni9yLmC1ovZP+Sr9z+PQskyk=\n=avQw\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201502-12\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: Oracle JRE/JDK: Multiple vulnerabilities\n Date: February 15, 2015\n Bugs: #507798, #508716, #517220, #525464\n ID: 201502-12\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Oracle's Java SE\nDevelopment Kit and Runtime Environment, the worst of which could lead\nto execution of arbitrary code. Please review the CVE\nidentifiers referenced below for details. \n\nImpact\n======\n\nA context-dependent attacker may be able to execute arbitrary code,\ndisclose, update, insert, or delete certain data. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Oracle JRE 1.7 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot -v \">=dev-java/oracle-jre-bin-1.7.0.71\"\n\nAll Oracle JDK 1.7 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot -v \">=dev-java/oracle-jdk-bin-1.7.0.71\"\n\nAll users of the precompiled 32-bit Oracle JRE should upgrade to the\nlatest version:\n\n # emerge --sync\n # emerge -a -1 -v \">=app-emulation/emul-linux-x86-java-1.7.0.71\"\n\nReferences\n==========\n\n[ 1 ] CVE-2014-0429\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0429\n[ 2 ] CVE-2014-0432\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0432\n[ 3 ] CVE-2014-0446\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0446\n[ 4 ] CVE-2014-0448\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0448\n[ 5 ] CVE-2014-0449\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0449\n[ 6 ] CVE-2014-0451\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0451\n[ 7 ] CVE-2014-0452\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0452\n[ 8 ] CVE-2014-0453\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0453\n[ 9 ] CVE-2014-0454\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0454\n[ 10 ] CVE-2014-0455\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0455\n[ 11 ] CVE-2014-0456\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0456\n[ 12 ] CVE-2014-0457\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0457\n[ 13 ] CVE-2014-0458\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0458\n[ 14 ] CVE-2014-0459\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0459\n[ 15 ] CVE-2014-0460\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0460\n[ 16 ] CVE-2014-0461\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0461\n[ 17 ] CVE-2014-0463\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0463\n[ 18 ] CVE-2014-0464\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0464\n[ 19 ] CVE-2014-2397\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2397\n[ 20 ] CVE-2014-2398\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2398\n[ 21 ] CVE-2014-2401\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2401\n[ 22 ] CVE-2014-2402\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2402\n[ 23 ] CVE-2014-2403\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2403\n[ 24 ] CVE-2014-2409\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2409\n[ 25 ] CVE-2014-2410\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2410\n[ 26 ] CVE-2014-2412\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2412\n[ 27 ] CVE-2014-2413\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2413\n[ 28 ] CVE-2014-2414\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2414\n[ 29 ] CVE-2014-2420\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2420\n[ 30 ] CVE-2014-2421\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2421\n[ 31 ] CVE-2014-2422\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2422\n[ 32 ] CVE-2014-2423\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2423\n[ 33 ] CVE-2014-2427\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2427\n[ 34 ] CVE-2014-2428\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2428\n[ 35 ] CVE-2014-2483\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2483\n[ 36 ] CVE-2014-2490\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2490\n[ 37 ] CVE-2014-4208\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4208\n[ 38 ] CVE-2014-4209\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4209\n[ 39 ] CVE-2014-4216\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4216\n[ 40 ] CVE-2014-4218\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4218\n[ 41 ] CVE-2014-4219\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4219\n[ 42 ] CVE-2014-4220\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4220\n[ 43 ] CVE-2014-4221\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4221\n[ 44 ] CVE-2014-4223\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4223\n[ 45 ] CVE-2014-4227\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4227\n[ 46 ] CVE-2014-4244\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4244\n[ 47 ] CVE-2014-4247\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4247\n[ 48 ] CVE-2014-4252\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4252\n[ 49 ] CVE-2014-4262\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4262\n[ 50 ] CVE-2014-4263\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4263\n[ 51 ] CVE-2014-4264\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4264\n[ 52 ] CVE-2014-4265\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4265\n[ 53 ] CVE-2014-4266\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4266\n[ 54 ] CVE-2014-4268\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4268\n[ 55 ] CVE-2014-4288\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4288\n[ 56 ] CVE-2014-6456\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6456\n[ 57 ] CVE-2014-6457\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6457\n[ 58 ] CVE-2014-6458\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6458\n[ 59 ] CVE-2014-6466\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6466\n[ 60 ] CVE-2014-6468\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6468\n[ 61 ] CVE-2014-6476\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6476\n[ 62 ] CVE-2014-6485\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6485\n[ 63 ] CVE-2014-6492\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6492\n[ 64 ] CVE-2014-6493\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6493\n[ 65 ] CVE-2014-6502\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6502\n[ 66 ] CVE-2014-6503\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6503\n[ 67 ] CVE-2014-6504\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6504\n[ 68 ] CVE-2014-6506\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6506\n[ 69 ] CVE-2014-6511\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6511\n[ 70 ] CVE-2014-6512\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6512\n[ 71 ] CVE-2014-6513\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6513\n[ 72 ] CVE-2014-6515\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6515\n[ 73 ] CVE-2014-6517\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6517\n[ 74 ] CVE-2014-6519\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6519\n[ 75 ] CVE-2014-6527\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6527\n[ 76 ] CVE-2014-6531\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6531\n[ 77 ] CVE-2014-6532\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6532\n[ 78 ] CVE-2014-6558\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6558\n[ 79 ] CVE-2014-6562\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6562\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201502-12.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users' machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2015 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. In a typical operating environment, these are of low\nsecurity risk as the runtime is not used on untrusted applets. Bugs fixed (https://bugzilla.redhat.com/):\n\n1031734 - CVE-2013-6629 libjpeg: information leak (read of uninitialized memory)\n1045561 - CVE-2013-6954 libpng: unhandled zero-length PLTE chunk or NULL palette\n1051519 - CVE-2014-0428 OpenJDK: insufficient security checks in IIOP streams (CORBA, 8025767)\n1051528 - CVE-2014-0422 OpenJDK: insufficient package access checks in the Naming component (JNDI, 8025758)\n1051699 - CVE-2014-0373 OpenJDK: SnmpStatusException handling issues (Serviceability, 7068126)\n1051823 - CVE-2013-5878 OpenJDK: null xmlns handling issue (Security, 8025026)\n1051911 - CVE-2013-5884 OpenJDK: insufficient security checks in CORBA stub factories (CORBA, 8026193)\n1051912 - CVE-2014-0416 OpenJDK: insecure subject principals set handling (JAAS, 8024306)\n1051923 - CVE-2014-0376 OpenJDK: document builder missing security checks (JAXP, 8027201, 8025018)\n1052915 - CVE-2013-5907 ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034)\n1052919 - CVE-2014-0368 OpenJDK: insufficient Socket checkListen checks (Networking, 8011786)\n1052942 - CVE-2013-5910 OpenJDK: XML canonicalizer mutable strings passed to untrusted code (Security, 8026417)\n1053010 - CVE-2014-0411 OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069)\n1053066 - CVE-2014-0423 OpenJDK: XXE issue in decoder (Beans, 8023245)\n1053266 - CVE-2013-5896 OpenJDK: com.sun.corba.se. \n\nRelease Date: 2014-08-19\nLast Updated: 2014-08-19\n\nPotential Security Impact: Remote unauthorized access, disclosure of\ninformation, and other vulnerabilities\n\nSource: Hewlett-Packard Company, HP Software Security Response Team\n\nVULNERABILITY SUMMARY\nPotential security vulnerabilities have been identified in Java Runtime\nEnvironment (JRE) and Java Developer Kit (JDK) running on HP-UX. These\nvulnerabilities could allow remote unauthorized access, disclosure of\ninformation, and other vulnerabilities. \n\nReferences:\n\nCVE-2013-6629\n\nCVE-2013-6954\n\nCVE-2014-0432\n\nCVE-2014-0446\n\nCVE-2014-0448\n\nCVE-2014-0449\n\nCVE-2014-0451\n\nCVE-2014-0452\n\nCVE-2014-0453\n\nCVE-2014-0454\n\nCVE-2014-0455\n\nCVE-2014-0456\n\nCVE-2014-0458\n\nCVE-2014-0459\n\nCVE-2014-0460\n\nCVE-2014-0461\n\nCVE-2014-1876\n\nCVE-2014-2397\n\nCVE-2014-2398\n\nCVE-2014-2401\n\nCVE-2014-2402\n\nCVE-2014-2403\n\nCVE-2014-2409\n\nCVE-2014-2412\n\nCVE-2014-2413\n\nCVE-2014-2414\n\nCVE-2014-2420\n\nCVE-2014-2421\n\nCVE-2014-2422\n\nCVE-2014-2423\n\nCVE-2014-2427\n\nCVE-2014-2428\n\nCVE-2014-2483\n\nCVE-2014-2490\n\nCVE-2014-4208\n\nCVE-2014-4209\n\nCVE-2014-4216\n\nCVE-2014-4218\n\nCVE-2014-4220\n\nCVE-2014-4221\n\nCVE-2014-4223\n\nCVE-2014-4244\n\nCVE-2014-4252\n\nCVE-2014-4262\n\nCVE-2014-4263\n\nCVE-2014-4264\n\nCVE-2014-4265\n\nCVE-2014-4266\n\nCVE-2014-4268\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \nHP-UX B.11.23, and B.11.31 running HP JDK and JRE v7.0.09 and earlier. \n\nBACKGROUND\n\nCVSS 2.0 Base Metrics\n===========================================================\n Reference Base Vector Base Score\nCVE-2013-6629 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0\nCVE-2013-6954 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0\nCVE-2014-0432 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2014-0446 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2014-0448 (AV:N/AC:H/Au:N/C:C/I:C/A:C) 7.6\nCVE-2014-0449 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0\nCVE-2014-0451 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2014-0452 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2014-0453 (AV:N/AC:H/Au:N/C:P/I:P/A:N) 4.0\nCVE-2014-0454 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2014-0455 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2014-0456 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0\nCVE-2014-0458 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2014-0459 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3\nCVE-2014-0460 (AV:N/AC:M/Au:N/C:P/I:P/A:N) 5.8\nCVE-2014-0461 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2014-1876 (AV:L/AC:M/Au:N/C:P/I:P/A:P) 4.4\nCVE-2014-2397 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2014-2398 (AV:N/AC:M/Au:S/C:N/I:P/A:N) 3.5\nCVE-2014-2401 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0\nCVE-2014-2402 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2014-2403 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0\nCVE-2014-2409 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4\nCVE-2014-2412 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2014-2413 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3\nCVE-2014-2414 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2014-2420 (AV:N/AC:H/Au:N/C:N/I:P/A:N) 2.6\nCVE-2014-2421 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0\nCVE-2014-2422 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8\nCVE-2014-2423 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2014-2427 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2014-2428 (AV:N/AC:H/Au:N/C:C/I:C/A:C) 7.6\nCVE-2014-2483 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2014-2490 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2014-4208 (AV:N/AC:H/Au:N/C:N/I:P/A:N) 2.6\nCVE-2014-4209 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4\nCVE-2014-4216 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2014-4218 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0\nCVE-2014-4220 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0\nCVE-2014-4221 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3\nCVE-2014-4223 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2014-4244 (AV:N/AC:H/Au:N/C:P/I:P/A:N) 4.0\nCVE-2014-4252 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0\nCVE-2014-4262 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2014-4263 (AV:N/AC:H/Au:N/C:P/I:P/A:N) 4.0\nCVE-2014-4264 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0\nCVE-2014-4265 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0\nCVE-2014-4266 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0\nCVE-2014-4268 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0\n===========================================================\n Information on CVSS is documented\n in HP Customer Notice: HPSN-2008-002\n\nRESOLUTION\n\nHP has provided the following Java version upgrade to resolve these\nvulnerabilities. \n\nThe upgrade is available from the following location: http://www.hp.com/java\n\nOS Version\n Release Version\n Depot Name\n\nHP-UX B.11.23, B.11.31\n JDK and JRE v7.0.10 or subsequent\n Itanium_JDK_JRE_7.0.10_Aug_2014_Java70_1.7.0.10.00_HP-UX_B.11.31_IA.depot\n\nMANUAL ACTIONS: Yes - Update\nFor Java v7.0 update to Java v7.0.10 or subsequent\n\nPRODUCT SPECIFIC INFORMATION\nHP-UX Software Assistant: HP-UX Software Assistant is an enhanced application\nthat replaces HP-UX Security Patch Check. It analyzes all Security Bulletins\nissued by HP and lists recommended actions that may apply to a specific HP-UX\nsystem. It can also download patches and create a depot automatically. For\nmore information see https://www.hp.com/go/swa\n\nThe following text is for use by the HP-UX Software Assistant. \n\nAFFECTED VERSIONS\n\nHP-UX B.11.23\nHP-UX B.11.31\n===========\nJdk70.JDK70-COM\nJdk70.JDK70-DEMO\nJdk70.JDK70-IPF32\nJdk70.JDK70-IPF64\nJre70.JRE70-COM\nJre70.JRE70-IPF32\nJre70.JRE70-IPF32-HS\nJre70.JRE70-IPF64\nJre70.JRE70-IPF64-HS\naction: install revision 1.7.0.10.00 or subsequent\n\nEND AFFECTED VERSIONS\n\nHISTORY\nVersion:1 (rev.1) - 19 August 2014 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running HP software products should be applied in\naccordance with the customer's patch management policy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HP Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hp.com. \n\nReport: To report a potential security vulnerability with any HP supported\nproduct, send Email to: security-alert@hp.com\n\nSubscribe: To initiate a subscription to receive future HP Security Bulletin\nalerts via Email:\nhttp://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here:\nhttps://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HP General Software\nHF = HP Hardware and Firmware\nMP = MPE/iX\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPI = Printing and Imaging\nPV = ProCurve\nST = Storage Software\nTU = Tru64 UNIX\nUX = HP-UX\n\nCopyright 2014 Hewlett-Packard Development Company, L.P. \nHewlett-Packard Company shall not be liable for technical or editorial errors\nor omissions contained herein. The information provided is provided \"as is\"\nwithout warranty of any kind. To the extent permitted by law, neither HP or\nits affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. \nHewlett-Packard Company and the names of Hewlett-Packard products referenced\nherein are trademarks of Hewlett-Packard Company in the United States and\nother countries. Other product and company names mentioned herein may be\ntrademarks of their respective owners. \n \n Note that the CVE-2014-0459 issue is in the lcms2 library, which has\n been patched to correct this flaw. The verification\n of md5 checksums and GPG signatures is performed automatically for you. You can obtain the\n GPG public key of the Mandriva Security Team by executing:\n\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\n\n You can view other update advisories for Mandriva Linux at:\n\n http://www.mandriva.com/en/support/security/advisories/\n\n If you want to report vulnerabilities, please contact\n\n security_(at)_mandriva.com\n _______________________________________________________________________\n\n Type Bits/KeyID Date User ID\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\n <security*mandriva.com>\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.12 (GNU/Linux)\n\niD8DBQFTdfckmqjQ0CJFipgRArKEAKCIiAR2WkLo3Vb0gzzQ5RDz7hQZ3gCcDC6A\n5xOtKkhOvonpLXoqBiAcXWQ=\n=qBk5\n-----END PGP SIGNATURE-----\n. \n\nFor the oldstable distribution (squeeze), these problems have been fixed\nin version 6b31-1.13.3-1~deb6u1. \n\nFor the stable distribution (wheezy), these problems have been fixed in\nversion 6b31-1.13.3-1~deb7u1. \n\nFor the testing distribution (jessie), these problems have been fixed in\nversion 6b31-1.13.3-1. \n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 6b31-1.13.3-1", sources: [ { db: "NVD", id: "CVE-2014-0453", }, { db: "JVNDB", id: "JVNDB-2014-002089", }, { db: "VULHUB", id: "VHN-67946", }, { db: "VULMON", id: "CVE-2014-0453", }, { db: "PACKETSTORM", id: "126182", }, { db: "PACKETSTORM", id: "126200", }, { db: "PACKETSTORM", id: "130400", }, { db: "PACKETSTORM", id: "127655", }, { db: "PACKETSTORM", id: "127938", }, { db: "PACKETSTORM", id: "126664", }, { db: "PACKETSTORM", id: "126494", }, { db: "PACKETSTORM", id: "126631", }, { db: "PACKETSTORM", id: "126320", }, ], trust: 2.61, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2014-0453", trust: 3.5, }, { db: "SECUNIA", id: "58415", trust: 1.8, }, { db: "SECUNIA", id: "59307", trust: 1.8, }, { db: "SECUNIA", id: "60580", trust: 1.8, }, { db: "SECUNIA", id: "60117", trust: 1.8, }, { db: "SECUNIA", id: "59082", trust: 1.8, }, { db: "SECUNIA", id: "59255", trust: 1.8, }, { db: "SECUNIA", id: "59438", trust: 1.8, }, { db: "SECUNIA", id: "59675", trust: 1.8, }, { db: "SECUNIA", id: "59071", trust: 1.8, }, { db: "SECUNIA", id: "59104", trust: 1.8, }, { db: "SECUNIA", id: "59324", trust: 1.8, }, { db: "SECUNIA", id: "61050", trust: 1.8, }, { db: "SECUNIA", id: "59722", trust: 1.8, }, { db: "SECUNIA", id: "59250", trust: 1.8, }, { db: "SECUNIA", id: "60574", trust: 1.8, }, { db: "SECUNIA", id: "61264", trust: 1.8, }, { db: "SECUNIA", id: "59194", trust: 1.8, }, { db: "SECUNIA", id: "59023", trust: 1.8, }, { db: "SECUNIA", id: "60498", trust: 1.8, }, { db: "SECUNIA", id: "59653", trust: 1.8, }, { db: "SECUNIA", id: "59022", trust: 1.8, }, { db: "SECUNIA", id: "60003", trust: 1.8, }, { db: "SECUNIA", id: "60111", trust: 1.8, }, { db: "SECUNIA", id: "59436", trust: 1.8, }, { db: "SECUNIA", id: "59733", trust: 1.8, }, { db: "JUNIPER", id: "JSA10698", trust: 1.8, }, { db: "BID", id: "66914", trust: 1.8, }, { db: "JVNDB", id: "JVNDB-2014-002089", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-201404-268", trust: 0.7, }, { db: "VULHUB", id: "VHN-67946", trust: 0.1, }, { db: "VULMON", id: "CVE-2014-0453", trust: 0.1, }, { db: "PACKETSTORM", id: "126182", trust: 0.1, }, { db: "PACKETSTORM", id: "126200", trust: 0.1, }, { db: "PACKETSTORM", id: "130400", trust: 0.1, }, { db: "PACKETSTORM", id: "127655", trust: 0.1, }, { db: "PACKETSTORM", id: "127938", trust: 0.1, }, { db: "PACKETSTORM", id: "126664", trust: 0.1, }, { db: "PACKETSTORM", id: "126494", trust: 0.1, }, { db: "PACKETSTORM", id: "126631", trust: 0.1, }, { db: "PACKETSTORM", id: "126320", trust: 0.1, }, ], sources: [ { db: "VULHUB", id: "VHN-67946", }, { db: "VULMON", id: "CVE-2014-0453", }, { db: "JVNDB", id: "JVNDB-2014-002089", }, { db: "PACKETSTORM", id: "126182", }, { db: "PACKETSTORM", id: "126200", }, { db: "PACKETSTORM", id: "130400", }, { db: "PACKETSTORM", id: "127655", }, { db: "PACKETSTORM", id: "127938", }, { db: "PACKETSTORM", id: "126664", }, { db: "PACKETSTORM", id: "126494", }, { db: "PACKETSTORM", id: "126631", }, { db: "PACKETSTORM", id: "126320", }, { db: "CNNVD", id: "CNNVD-201404-268", }, { db: "NVD", id: "CVE-2014-0453", }, ], }, id: "VAR-201404-0374", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "VULHUB", id: "VHN-67946", }, ], trust: 0.01, }, last_update_date: "2024-11-29T22:35:28.945000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "HS14-009", trust: 0.8, url: "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-009/index.html", }, { title: "1672080", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21672080", }, { title: "1681018", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21681018", }, { title: "1673836", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21673836", }, { title: "1679713", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21679713", }, { title: "MIGR-5096132", trust: 0.8, url: "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132", }, { title: "1674539", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21674539", }, { title: "1677387", trust: 0.8, url: "http://www.ibm.com/support/docview.wss?uid=swg21677387", }, { title: "1675945", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21675945", }, { title: "1682828", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21682828", }, { title: "1676703", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21676703", }, { title: "1680387", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21680387 ", }, { title: "1674530", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21674530", }, { title: "1678113", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21678113", }, { title: "1675588", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21675588", }, { title: "1681256", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21681256", }, { title: "1675343", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21675343", }, { title: "1681047", trust: 0.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21681047", }, { title: "Text Form of Oracle Critical Patch Update - April 2014 Risk Matrices", trust: 0.8, url: "http://www.oracle.com/technetwork/topics/security/cpuapr2014verbose-1972954.html", }, { title: "Oracle Critical Patch Update Advisory - April 2014", trust: 0.8, url: "http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html", }, { title: "April 2014 Critical Patch Update Released", trust: 0.8, url: "https://blogs.oracle.com/security/entry/april_2014_critical_patch_update", }, { title: "JSA10698", trust: 0.8, url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698&actp=search", }, { title: "HS14-009", trust: 0.8, url: "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-009/index.html", }, { title: "Oracle Corporation Javaプラグインの脆弱性に関するお知らせ", trust: 0.8, url: "http://www.fmworld.net/biz/common/oracle/20140417.html", }, { title: "jdk-7u55-nb-8-linux-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49311", }, { title: "jdk-8u5-windows-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49315", }, { title: "jre-8u5-macosx-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49319", }, { title: "jdk-7u55-nb-8-macosx-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49310", }, { title: "jre-7u55-linux-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49314", }, { title: "jre-8u5-windows-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49318", }, { title: "jdk-7u55-nb-8-windows-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49309", }, { title: "jre-7u55-macosx-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49313", }, { title: "jdk-8u5-linux-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49317", }, { title: "jre-7u55-windows-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49312", }, { title: "jdk-8u5-macosx-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49316", }, { title: "jre-8u5-linux-x64", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49320", }, { title: "Red Hat: CVE-2014-0453", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2014-0453", }, { title: "Ubuntu Security Notice: openjdk-7 vulnerabilities", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-2187-1", }, { title: "Ubuntu Security Notice: openjdk-6 vulnerabilities", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-2191-1", }, { title: "Amazon Linux AMI: ALAS-2014-326", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2014-326", }, { title: "Amazon Linux AMI: ALAS-2014-327", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2014-327", }, ], sources: [ { db: "VULMON", id: "CVE-2014-0453", }, { db: "JVNDB", id: "JVNDB-2014-002089", }, { db: "CNNVD", id: "CNNVD-201404-268", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "NVD-CWE-noinfo", trust: 1, }, ], sources: [ { db: "NVD", id: "CVE-2014-0453", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 2, url: "http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html", }, { trust: 1.9, url: "http://www.securityfocus.com/bid/66914", }, { trust: 1.9, url: "http://security.gentoo.org/glsa/glsa-201502-12.xml", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21672080", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21673836", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21674539", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21675945", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21676190", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21676373", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21676672", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21676703", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21677294", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21678113", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21679610", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21679713", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21680387", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21680750", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21681018", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21681047", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21681256", }, { trust: 1.8, url: "http://www-01.ibm.com/support/docview.wss?uid=swg21683484", }, { trust: 1.8, url: "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5096132", }, { trust: 1.8, url: "http://www.ibm.com/support/docview.wss?uid=swg21675343", }, { trust: 1.8, url: "http://www.ibm.com/support/docview.wss?uid=swg21675588", }, { trust: 1.8, url: "http://www.ibm.com/support/docview.wss?uid=swg21677387", }, { trust: 1.8, url: "https://www.ibm.com/support/docview.wss?uid=swg21674530", }, { trust: 1.8, url: "http://www.debian.org/security/2014/dsa-2912", }, { trust: 1.8, url: "http://security.gentoo.org/glsa/glsa-201406-32.xml", }, { trust: 1.8, url: "https://access.redhat.com/errata/rhsa-2014:0413", }, { trust: 1.8, url: "https://access.redhat.com/errata/rhsa-2014:0414", }, { trust: 1.8, url: "http://rhn.redhat.com/errata/rhsa-2014-0675.html", }, { trust: 1.8, url: "http://rhn.redhat.com/errata/rhsa-2014-0685.html", }, { trust: 1.8, url: "http://secunia.com/advisories/58415", }, { trust: 1.8, url: "http://secunia.com/advisories/59022", }, { trust: 1.8, url: "http://secunia.com/advisories/59023", }, { trust: 1.8, url: "http://secunia.com/advisories/59071", }, { trust: 1.8, url: "http://secunia.com/advisories/59082", }, { trust: 1.8, url: "http://secunia.com/advisories/59104", }, { trust: 1.8, url: "http://secunia.com/advisories/59194", }, { trust: 1.8, url: "http://secunia.com/advisories/59250", }, { trust: 1.8, url: "http://secunia.com/advisories/59255", }, { trust: 1.8, url: "http://secunia.com/advisories/59307", }, { trust: 1.8, url: "http://secunia.com/advisories/59324", }, { trust: 1.8, url: "http://secunia.com/advisories/59436", }, { trust: 1.8, url: "http://secunia.com/advisories/59438", }, { trust: 1.8, url: "http://secunia.com/advisories/59653", }, { trust: 1.8, url: "http://secunia.com/advisories/59675", }, { trust: 1.8, url: "http://secunia.com/advisories/59722", }, { trust: 1.8, url: "http://secunia.com/advisories/59733", }, { trust: 1.8, url: "http://secunia.com/advisories/60003", }, { trust: 1.8, url: "http://secunia.com/advisories/60111", }, { trust: 1.8, url: "http://secunia.com/advisories/60117", }, { trust: 1.8, url: "http://secunia.com/advisories/60498", }, { trust: 1.8, url: "http://secunia.com/advisories/60574", }, { trust: 1.8, url: "http://secunia.com/advisories/60580", }, { trust: 1.8, url: "http://secunia.com/advisories/61050", }, { trust: 1.8, url: "http://secunia.com/advisories/61264", }, { trust: 1.8, url: "http://www.ubuntu.com/usn/usn-2187-1", }, { trust: 1.8, url: "http://www.ubuntu.com/usn/usn-2191-1", }, { trust: 1.7, url: "http://kb.juniper.net/infocenter/index?page=content&id=jsa10698", }, { trust: 1.7, url: "http://marc.info/?l=bugtraq&m=140852974709252&w=2", }, { trust: 1.7, url: "http://marc.info/?l=bugtraq&m=140852886808946&w=2", }, { trust: 0.9, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0453", }, { trust: 0.8, url: "http://www.ipa.go.jp/security/ciadr/vul/20140416-jre.html", }, { trust: 0.8, url: "http://www.jpcert.or.jp/at/2014/at140017.html", }, { trust: 0.8, url: "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0453", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0446", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0429", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2412", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0451", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2414", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2398", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0458", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0452", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0460", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0461", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0453", }, { trust: 0.7, url: "https://nvd.nist.gov/vuln/detail/cve-2014-1876", }, { trust: 0.7, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0456", }, { trust: 0.7, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0457", }, { trust: 0.7, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2403", }, { trust: 0.7, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2397", }, { trust: 0.7, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0459", }, { trust: 0.6, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2413", }, { trust: 0.6, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0455", }, { trust: 0.6, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0454", }, { trust: 0.6, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2402", }, { trust: 0.6, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2421", }, { trust: 0.5, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2427", }, { trust: 0.5, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2423", }, { trust: 0.5, url: "https://nvd.nist.gov/vuln/detail/cve-2013-6629", }, { trust: 0.5, url: "https://nvd.nist.gov/vuln/detail/cve-2013-6954", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-0451.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-0453.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-2421.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-0452.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-2423.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-0461.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-2427.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-0446.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-2414.html", }, { trust: 0.4, url: "https://access.redhat.com/security/team/contact/", }, { trust: 0.4, url: "https://www.redhat.com/mailman/listinfo/rhsa-announce", }, { trust: 0.4, url: "https://bugzilla.redhat.com/):", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-0458.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-1876.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-0460.html", }, { trust: 0.4, url: "https://access.redhat.com/security/team/key/#package", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-2412.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-2398.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-0457.html", }, { trust: 0.4, url: "https://www.redhat.com/security/data/cve/cve-2014-0429.html", }, { trust: 0.4, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0449", }, { trust: 0.4, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2409", }, { trust: 0.4, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2401", }, { trust: 0.3, url: "https://access.redhat.com/site/articles/11258", }, { trust: 0.3, url: "https://access.redhat.com/security/updates/classification/#critical", }, { trust: 0.3, url: "https://www.redhat.com/security/data/cve/cve-2014-2420.html", }, { trust: 0.3, url: "https://www.redhat.com/security/data/cve/cve-2014-2409.html", }, { trust: 0.3, url: "https://www.redhat.com/security/data/cve/cve-2014-0449.html", }, { trust: 0.3, url: "https://www.redhat.com/security/data/cve/cve-2013-6629.html", }, { trust: 0.3, url: "https://www.redhat.com/security/data/cve/cve-2013-6954.html", }, { trust: 0.3, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0432", }, { trust: 0.3, url: "https://www.redhat.com/security/data/cve/cve-2014-2428.html", }, { trust: 0.3, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0448", }, { trust: 0.3, url: "https://www.redhat.com/security/data/cve/cve-2014-2401.html", }, { trust: 0.2, url: "https://www.redhat.com/security/data/cve/cve-2014-0459.html", }, { trust: 0.2, url: "https://www.redhat.com/security/data/cve/cve-2014-0454.html", }, { trust: 0.2, url: "https://www.redhat.com/security/data/cve/cve-2014-2397.html", }, { trust: 0.2, url: "https://www.redhat.com/security/data/cve/cve-2014-2413.html", }, { trust: 0.2, url: "https://www.redhat.com/security/data/cve/cve-2014-0456.html", }, { trust: 0.2, url: "https://rhn.redhat.com/errata/rhsa-2014-0406.html", }, { trust: 0.2, url: "https://www.redhat.com/security/data/cve/cve-2014-2403.html", }, { trust: 0.2, url: "https://www.redhat.com/security/data/cve/cve-2014-0455.html", }, { trust: 0.2, url: "https://www.redhat.com/security/data/cve/cve-2014-2402.html", }, { trust: 0.2, url: "https://www.ibm.com/developerworks/java/jdk/alerts/", }, { trust: 0.2, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2420", }, { trust: 0.2, url: "http://www.debian.org/security/faq", }, { trust: 0.2, url: "http://www.debian.org/security/", }, { trust: 0.1, url: "http://kb.juniper.net/infocenter/index?page=content&id=jsa10698", }, { trust: 0.1, url: "http://marc.info/?l=bugtraq&m=140852886808946&w=2", }, { trust: 0.1, url: "http://marc.info/?l=bugtraq&m=140852974709252&w=2", }, { trust: 0.1, url: "https://cwe.mitre.org/data/definitions/.html", }, { trust: 0.1, url: "https://nvd.nist.gov", }, { trust: 0.1, url: "https://access.redhat.com/security/cve/cve-2014-0453", }, { trust: 0.1, url: "https://usn.ubuntu.com/2187-1/", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0432.html", }, { trust: 0.1, url: "https://rhn.redhat.com/errata/rhsa-2014-0413.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0448.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-2422.html", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6562", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6458", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0455", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2412", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0454", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2414", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6531", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6493", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6532", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2401", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2409", }, { trust: 0.1, url: "http://creativecommons.org/licenses/by-sa/2.5", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4266", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6456", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4219", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4209", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4263", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0463", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2421", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6457", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6468", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4247", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6511", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4265", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6513", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6504", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2402", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2420", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0457", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0451", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0459", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0464", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2423", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4221", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0458", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6527", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4216", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2403", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2398", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2422", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4227", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4252", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4244", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4262", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0461", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2427", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2490", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0429", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4208", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0463", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6492", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2410", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6512", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4264", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0456", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6466", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6517", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0460", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4288", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6558", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0448", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6519", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2483", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6485", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0432", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4223", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2397", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0452", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0446", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2428", }, { trust: 0.1, url: "http://security.gentoo.org/", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6476", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0453", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0449", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6502", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4268", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4218", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4220", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2410", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6506", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0464", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-2413", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6503", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6515", }, { trust: 0.1, url: "https://bugs.gentoo.org.", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2013-5896.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2013-5887", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0878.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2013-5910", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0428.html", }, { trust: 0.1, url: "https://access.redhat.com/articles/11258", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2013-5910.html", }, { trust: 0.1, url: "https://rhn.redhat.com/errata/rhsa-2014-0982.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0417", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2013-5878", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2013-5907", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0376", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2013-5899.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0368", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0416.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0428", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0403.html", }, { trust: 0.1, url: "https://access.redhat.com/security/updates/classification/#low", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0415", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0411", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0422", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0422.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0368.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0415.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2013-5889.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2013-5884", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0375.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0423", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0423.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2013-5878.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0376.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0410", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0410.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2013-5898", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2013-5889", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0424", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2013-5907.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0373.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0411.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0416", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0417.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0424.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0373", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2013-5888", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2013-5898.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2013-5884.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2013-5899", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0403", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0375", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2013-5887.html", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2014-0387.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2013-5896", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2013-5888.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0387", }, { trust: 0.1, url: "http://www.hp.com/java", }, { trust: 0.1, url: "http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins", }, { trust: 0.1, url: "https://www.hp.com/go/swa", }, { trust: 0.1, url: "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/", }, { trust: 0.1, url: "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2403", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0461", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0452", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0455", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-1876", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0456", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2397", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2421", }, { trust: 0.1, url: "http://www.mandriva.com/en/support/security/", }, { trust: 0.1, url: "http://blog.fuseyism.com/index.php/2014/04/16/security-icedtea-2-4-7-for-openjdk-7-released/", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2413", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2402", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2412", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2414", }, { trust: 0.1, url: "http://www.mandriva.com/en/support/security/advisories/", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0460", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0429", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0454", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2423", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2427", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0458", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0451", }, { trust: 0.1, url: "http://advisories.mageia.org/mgasa-2014-0189.html", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0446", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0459", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0457", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2398", }, { trust: 0.1, url: "https://rhn.redhat.com/errata/rhsa-2014-0508.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2428", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-0462", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2014-2405", }, ], sources: [ { db: "VULHUB", id: "VHN-67946", }, { db: "VULMON", id: "CVE-2014-0453", }, { db: "JVNDB", id: "JVNDB-2014-002089", }, { db: "PACKETSTORM", id: "126182", }, { db: "PACKETSTORM", id: "126200", }, { db: "PACKETSTORM", id: "130400", }, { db: "PACKETSTORM", id: "127655", }, { db: "PACKETSTORM", id: "127938", }, { db: "PACKETSTORM", id: "126664", }, { db: "PACKETSTORM", id: "126494", }, { db: "PACKETSTORM", id: "126631", }, { db: "PACKETSTORM", id: "126320", }, { db: "CNNVD", id: "CNNVD-201404-268", }, { db: "NVD", id: "CVE-2014-0453", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "VULHUB", id: "VHN-67946", }, { db: "VULMON", id: "CVE-2014-0453", }, { db: "JVNDB", id: "JVNDB-2014-002089", }, { db: "PACKETSTORM", id: "126182", }, { db: "PACKETSTORM", id: "126200", }, { db: "PACKETSTORM", id: "130400", }, { db: "PACKETSTORM", id: "127655", }, { db: "PACKETSTORM", id: "127938", }, { db: "PACKETSTORM", id: "126664", }, { db: "PACKETSTORM", id: "126494", }, { db: "PACKETSTORM", id: "126631", }, { db: "PACKETSTORM", id: "126320", }, { db: "CNNVD", id: "CNNVD-201404-268", }, { db: "NVD", id: "CVE-2014-0453", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2014-04-16T00:00:00", db: "VULHUB", id: "VHN-67946", }, { date: "2014-04-16T00:00:00", db: "VULMON", id: "CVE-2014-0453", }, { date: "2014-04-17T00:00:00", db: "JVNDB", id: "JVNDB-2014-002089", }, { date: "2014-04-16T20:42:08", db: "PACKETSTORM", id: "126182", }, { date: "2014-04-17T22:02:41", db: "PACKETSTORM", id: "126200", }, { date: "2015-02-16T17:24:02", db: "PACKETSTORM", id: "130400", }, { date: "2014-07-29T22:17:21", db: "PACKETSTORM", id: "127655", }, { date: "2014-08-20T15:19:26", db: "PACKETSTORM", id: "127938", }, { date: "2014-05-19T03:11:59", db: "PACKETSTORM", id: "126664", }, { date: "2014-05-06T00:17:25", db: "PACKETSTORM", id: "126494", }, { date: "2014-05-15T21:38:43", db: "PACKETSTORM", id: "126631", }, { date: "2014-04-25T17:49:43", db: "PACKETSTORM", id: "126320", }, { date: "2014-04-18T00:00:00", db: "CNNVD", id: "CNNVD-201404-268", }, { date: "2014-04-16T01:55:09.713000", db: "NVD", id: "CVE-2014-0453", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2022-05-09T00:00:00", db: "VULHUB", id: "VHN-67946", }, { date: "2020-09-08T00:00:00", db: "VULMON", id: "CVE-2014-0453", }, { date: "2015-12-02T00:00:00", db: "JVNDB", id: "JVNDB-2014-002089", }, { date: "2020-10-23T00:00:00", db: "CNNVD", id: "CNNVD-201404-268", }, { date: "2024-11-21T02:02:09.460000", db: "NVD", id: "CVE-2014-0453", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "remote", sources: [ { db: "PACKETSTORM", id: "126182", }, { db: "PACKETSTORM", id: "127938", }, { db: "PACKETSTORM", id: "126664", }, { db: "CNNVD", id: "CNNVD-201404-268", }, ], trust: 0.9, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "plural Oracle Java In product Security Vulnerabilities", sources: [ { db: "JVNDB", id: "JVNDB-2014-002089", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "other", sources: [ { db: "CNNVD", id: "CNNVD-201404-268", }, ], trust: 0.6, }, }
Log in or create an account to share your comment.
This schema specifies the format of a comment related to a security advisory.
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.