CVE-2014-2397: Critical severity Canonical Ubuntu Linux vulnerability
It was discovered that the class file parser did not properly parse class files with an invalid BootstrapMethods attribute length. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2397?
CVE-2014-2397 is considered a medium severity vulnerability due to its potential to bypass Java sandbox restrictions.
How do I fix CVE-2014-2397?
To remediate CVE-2014-2397, update your Java version to at least 1.7.0-update55 or 1.8.0 or apply the appropriate patches for your operating system.
What causes CVE-2014-2397?
CVE-2014-2397 is caused by improper parsing of class files with an invalid BootstrapMethods attribute length in Java applications.
Which Java versions are affected by CVE-2014-2397?
CVE-2014-2397 affects Oracle Java SE 7u51 and 8, as well as various releases of IcedTea and Oracle JDK.
Can CVE-2014-2397 be exploited by untrusted applications?
Yes, CVE-2014-2397 allows untrusted Java applications or applets to potentially bypass Java sandbox restrictions.