CVE-2014-0456: Critical severity Canonical Ubuntu Linux vulnerability
It was discovered that the System.arraycopy() method has a race condition between verifying source elements and storing them. An untrusted Java application or applet could possibly use this flaw to trigger a Java Virtual Machine memory corruption.
Other sources
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0456?
The severity of CVE-2014-0456 is considered high due to potential memory corruption risks in Java applications.
How do I fix CVE-2014-0456?
To fix CVE-2014-0456, update your Java Runtime Environment to the latest available patch that addresses this vulnerability.
Which software versions are affected by CVE-2014-0456?
CVE-2014-0456 affects various versions of Oracle Java SE, JRockit, and multiple distributions of Linux such as Ubuntu and Debian.
Can untrusted Java applications exploit CVE-2014-0456?
Yes, untrusted Java applications or applets can exploit CVE-2014-0456 to potentially trigger memory corruption.
Is CVE-2014-0456 relevant for users of the Java Runtime Environment?
Yes, CVE-2014-0456 is highly relevant for users of the Java Runtime Environment as it poses security risks that can be exploited.