CVE-2014-0446: High severity Canonical Ubuntu Linux vulnerability
It was discovered that the system logger was not properly protected against using handlers of custom loggers created prior to the system logger. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0446?
CVE-2014-0446 is generally considered a high severity vulnerability due to its potential to bypass Java sandbox restrictions.
How do I fix CVE-2014-0446?
To fix CVE-2014-0446, upgrade to the patched versions of the affected packages, such as icedtea 1.13.3 or 2.4.7.
Which software is affected by CVE-2014-0446?
CVE-2014-0446 affects various versions of Oracle Java SE, including JDK and JRE from 1.5.0 to 1.8.0, as well as multiple versions of icedtea.
Can CVE-2014-0446 be exploited remotely?
Yes, CVE-2014-0446 can potentially be exploited remotely by untrusted Java applications or applets.
What is the impact of CVE-2014-0446?
The impact of CVE-2014-0446 includes potential unauthorized access and control over the system by bypassing security restrictions.