CVE-2014-0459: Medium severity Canonical Ubuntu Linux vulnerability
It was discovered that ICC profiles were not parsed correctly. An untrusted Java application or applet could possibly use this flaw to cause a denial of service.
Other sources
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0459?
CVE-2014-0459 is classified as a denial of service vulnerability.
How do I fix CVE-2014-0459?
To mitigate CVE-2014-0459, update to a version of Oracle Java SE that is above 1.7.0-update51 or 1.8.0.
Which software is affected by CVE-2014-0459?
CVE-2014-0459 affects Oracle Java SE 7u51, Oracle Java SE 8, and various versions of Debian and Ubuntu Linux.
Can CVE-2014-0459 be exploited remotely?
Yes, CVE-2014-0459 can be exploited remotely by untrusted Java applications or applets.
What type of attack does CVE-2014-0459 enable?
CVE-2014-0459 enables a denial of service attack due to the incorrect parsing of ICC profiles.