medium
5.5
Advisory Published
CVE Published
Updated

CVE-2014-0423

First published: Tue Jan 14 2014(Updated: )

It was discovered that the decoder (DocumentHandler in OpenJDK 7 and ObjectHandler OpenJDK 6) allowed processing of XML external entities. An application using JavaBeans could possibly disclose sensitive information, or be target of a DoS attack, triggered via XML external entities.

Credit: secalert_us@oracle.com

Affected SoftwareAffected VersionHow to fix
redhat/icedtea<2.4.4
2.4.4
redhat/icedtea<2.3.13
2.3.13
redhat/icedtea<1.12.8
1.12.8
redhat/icedtea<1.13.1
1.13.1
Oracle Java SE=r27.7.7
Oracle Java SE=r28.2.9
Oracle JRE=1.7.0-update45
Oracle OpenJDK 1.8.0=1.6.0-update65
Oracle JRE=1.6.0-update65
Oracle OpenJDK 1.8.0=1.5.0-update55
Oracle JRE=1.5.0-update55

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2014-0423?

    CVE-2014-0423 is classified as a medium-severity vulnerability that can lead to information disclosure or Denial of Service attacks.

  • How do I fix CVE-2014-0423?

    To address CVE-2014-0423, upgrade to a non-vulnerable version of the affected packages, such as icedtea 2.4.4 or JDK 1.7.0-update45.

  • What applications are affected by CVE-2014-0423?

    CVE-2014-0423 affects applications utilizing JavaBeans that process XML external entities, specifically in OpenJDK and Oracle JDK versions.

  • What types of attacks can be executed due to CVE-2014-0423?

    CVE-2014-0423 can enable attackers to perform information disclosure and Denial of Service (DoS) attacks via malicious XML content.

  • Is there any workaround for CVE-2014-0423 if I cannot update immediately?

    A recommended temporary workaround for CVE-2014-0423 is to disable the processing of XML external entities in your application configuration until a patch can be applied.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203