CVE-2014-0461: Critical severity Canonical Ubuntu Linux vulnerability
It was discovered that the ScriptEngineManager did not properly manage ScriptEngines. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 6u71 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 7u51 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 8 - Upgrade
Upgrade
Oracle Java SE Embeddedto a version that resolves this vulnerability.Fixed in 7u51
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0461?
CVE-2014-0461 has a high severity level due to its potential to bypass Java sandbox restrictions.
How do I fix CVE-2014-0461?
To fix CVE-2014-0461, update Oracle JDK and JRE versions to the latest available updates.
Which software is affected by CVE-2014-0461?
CVE-2014-0461 affects Oracle Java SE 6 versions 6u71, 7 versions 7u51, and 8 as well as specific versions of IcedTea.
Can CVE-2014-0461 be exploited remotely?
Yes, an untrusted Java application or applet can remotely exploit CVE-2014-0461.
What happens if I am vulnerable to CVE-2014-0461?
Being vulnerable to CVE-2014-0461 could allow attackers to bypass security restrictions and execute untrusted code.