CVE-2014-0455: Critical severity Ubuntu vulnerability
It was discovered that MethodHandle did not properly handle variable argument lists when permuting or dropping arguments. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-2402.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7 - Upgrade
Upgrade
Oracle Java SE 7u51to a version that resolves this vulnerability.Fixed in 8 - Upgrade
Upgrade
Oracle Java SE 8to a version that resolves this vulnerability.Fixed in 8 - Upgrade
Upgrade
Oracle Java SE Embedded 7u51to a version that resolves this vulnerability.Fixed in 8 - Compensating control
Mitigate risk from the Java sandbox by restricting access to untrusted Java applets/applications (prevent or limit execution of untrusted Java applets in browsers where possible).
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0455?
CVE-2014-0455 has been classified as a high severity vulnerability.
How does CVE-2014-0455 affect Java applications?
CVE-2014-0455 allows an untrusted Java application to potentially bypass Java sandbox restrictions.
Which software versions are affected by CVE-2014-0455?
CVE-2014-0455 affects Oracle Java SE 7u51, 8, and certain versions of IBM Forms Viewer on different platforms.
How do I fix CVE-2014-0455?
To fix CVE-2014-0455, you should update affected versions of Oracle JDK, JRE, or IcedTea to the latest patched versions.
Is there a patch available for CVE-2014-0455?
Yes, security patches are available for CVE-2014-0455 in the respective updates from Oracle and Red Hat.