CVE-2014-2398: Low severity Canonical Ubuntu Linux vulnerability
It was discovered that the fix for CVE-2013-5797 (bug 1018720) did not properly with the issue in the way javadoc (Java API Documentation Generator) created a JavaScript code used to set browser window title when navigating between pages of the generated API documentation. An input from user was not properly escaped before being used as part of the JavaScript string. A specially crafted input could "break out" of the JS string and execute arbitrary JavaScript in the context of the domain that hosts generated API documentation, allowing a Cross-Site Scripting attacks.
The original fix for the issue added escaping of quotes and non-ASCII characters, but it failed to escape HTML special characters < and >.
Acknowledgement:
This issue was discovered by the Red Hat Security Response Team.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2398?
CVE-2014-2398 is classified as having moderate severity due to the potential impact on the confidentiality and integrity of affected systems.
How do I fix CVE-2014-2398?
To fix CVE-2014-2398, you should update to the latest version of IcedTea or the appropriate Oracle JDK or JRE that addresses the vulnerability.
Which software versions are affected by CVE-2014-2398?
CVE-2014-2398 affects specific versions of IcedTea and various Oracle JDK and JRE versions along with several Debian and Ubuntu releases.
Is CVE-2014-2398 exploitable remotely?
Yes, CVE-2014-2398 can be exploited remotely, allowing an attacker to potentially execute arbitrary code.
What should I do if I cannot immediately update for CVE-2014-2398?
If immediate updates are not possible for CVE-2014-2398, implementing temporary mitigation measures like network segmentation or firewall rules is advisable.