CVE-2014-2402: High severity Canonical Ubuntu Linux vulnerability
It was discovered that NIO channels were not properly separated across threads. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-0455.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2402?
CVE-2014-2402 is considered a high-severity vulnerability due to its potential to bypass Java sandbox restrictions.
How do I fix CVE-2014-2402?
To fix CVE-2014-2402, update to the latest version of Oracle Java or apply the necessary security patches provided by your distribution.
Which versions of Java are affected by CVE-2014-2402?
CVE-2014-2402 affects Oracle Java SE 7u51 and 8, as well as Java SE Embedded 7u51.
Can CVE-2014-2402 be exploited remotely?
Yes, CVE-2014-2402 can be exploited remotely by an untrusted Java application or applet.
What types of applications are at risk due to CVE-2014-2402?
Any application using the affected versions of Oracle Java, particularly those allowing untrusted applet execution, is at risk due to CVE-2014-2402.