CVE-2014-0376: Medium severity Oracle JDK vulnerability
It was discovered that the JAXP (Java API for XML Processing) component in OpenJDK did not properly check code permissions when creating document builder factories. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an improper check for "code permissions when creating document builder factories."
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.4 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.3.13 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.12.8 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.1 - Upgrade
Upgrade
Oracle Java SE 5.0to a version that resolves this vulnerability.Fixed in 5.0u55 - Upgrade
Upgrade
Oracle Java SE 6to a version that resolves this vulnerability.Fixed in 6u65 - Upgrade
Upgrade
Oracle Java SE 7to a version that resolves this vulnerability.Fixed in 7u45 - Upgrade
Upgrade
Java SE Embedded 7to a version that resolves this vulnerability.Fixed in 7u45 - Upgrade
Upgrade
OpenJDK 7to a version that resolves this vulnerability.Fixed in 7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0376?
CVE-2014-0376 is considered a high severity vulnerability due to its potential to bypass Java sandbox restrictions.
How do I fix CVE-2014-0376?
To fix CVE-2014-0376, update to the latest version of the affected software packages such as icedtea or Oracle Java runtimes.
Which versions of software are affected by CVE-2014-0376?
CVE-2014-0376 affects several versions of icedtea, Oracle JDK, and Oracle JRE, specifically versions prior to 2.4.4 and 1.7.0-update45.
What components are involved in CVE-2014-0376?
CVE-2014-0376 involves the JAXP component in OpenJDK, which improperly checks code permissions.
Can an attacker exploit CVE-2014-0376 remotely?
Yes, an attacker can exploit CVE-2014-0376 remotely using an untrusted Java application or applet.