CVE-2014-2403: Medium severity Canonical Ubuntu Linux vulnerability
It was discovered that JAXP the CharInfo object did not properly prevent access to arbitrary files when a SecurityManager is present. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information.
Other sources
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via vectors related to JAXP.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2403?
The severity of CVE-2014-2403 is classified as high due to its potential to disclose sensitive information.
How do I fix CVE-2014-2403?
To fix CVE-2014-2403, update to the latest version of the affected software such as icedtea 1.13.3 or 2.4.7, or the appropriate Oracle Java version.
What versions of software are affected by CVE-2014-2403?
CVE-2014-2403 affects Oracle Java SE versions 6u71, 7u51, and 1.8.0, as well as specific versions of icedtea and various Debian and Ubuntu distributions.
Can CVE-2014-2403 be exploited remotely?
Yes, CVE-2014-2403 can potentially be exploited remotely by untrusted Java applications or applets.
What are the potential impacts of CVE-2014-2403?
The potential impacts of CVE-2014-2403 include unauthorized access and disclosure of sensitive information on affected systems.