CVE-2014-0452: High severity Canonical Ubuntu Linux vulnerability
It was discovered that JAXWS incorrectly cached certain data initialized via thread context class loaders. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0452?
CVE-2014-0452 has been assigned a medium severity rating due to its potential impact on Java applications.
How do I fix CVE-2014-0452?
To fix CVE-2014-0452, upgrade your Java version to a release that addresses this vulnerability.
Which versions are affected by CVE-2014-0452?
CVE-2014-0452 affects Oracle Java SE versions 6u71, 7u51, and 8, as well as certain versions of IcedTea and specific Debian and Ubuntu releases.
Can CVE-2014-0452 be exploited remotely?
Yes, CVE-2014-0452 could allow an untrusted Java application to bypass sandbox restrictions if successfully exploited.
Is there a workaround for CVE-2014-0452?
The best approach is to update to the latest version of Java, although disabling the Java plugin in browsers can serve as a temporary workaround.