CVE-2014-0458: High severity Canonical Ubuntu Linux vulnerability
It was discovered that the activation framework did not properly protect the default command map. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0458?
CVE-2014-0458 has been classified as a high severity vulnerability due to its potential to allow untrusted Java applications to bypass sandbox restrictions.
How do I fix CVE-2014-0458?
To fix CVE-2014-0458, update your Oracle Java SE to the latest version or apply the relevant patches provided by your operating system vendor.
Which versions of Oracle Java are affected by CVE-2014-0458?
CVE-2014-0458 affects Oracle Java SE 6u71, 7u51, and 8, along with Oracle JDK and JRE versions corresponding to these updates.
What systems are impacted by CVE-2014-0458?
CVE-2014-0458 impacts various systems including Oracle Java SE, IcedTea, Ubuntu, and Debian distributions that include affected versions of Java.
Can CVE-2014-0458 lead to arbitrary code execution?
Yes, CVE-2014-0458 has the potential to allow arbitrary code execution if exploited by an untrusted Java application or applet.