CVE-2014-0457: Critical severity Oracle Jrockit vulnerability
It was discovered that the ServiceLoader did not perform exception handling in a secure manner. An untrusted Java application or applet could possibly use this flaw to bypass security mechanisms and perform operations with full permissions.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0457?
CVE-2014-0457 is considered a critical vulnerability due to its potential to allow untrusted Java applications to bypass security mechanisms.
How do I fix CVE-2014-0457?
To mitigate CVE-2014-0457, update to the recommended versions of the affected software, such as IcedTea 1.13.3 or later, and Oracle JDK versions that include the fix.
What software is affected by CVE-2014-0457?
CVE-2014-0457 affects multiple versions of Oracle JDK, JRE, and IcedTea, as well as specific versions of Ubuntu and Debian Linux.
Can CVE-2014-0457 be exploited remotely?
Yes, CVE-2014-0457 can be exploited remotely if an untrusted Java application is executed, potentially allowing an attacker to gain full permissions.
What are the consequences of not addressing CVE-2014-0457?
Failing to address CVE-2014-0457 may lead to unauthorized access and control over affected systems, posing significant security risks.