CVE-2014-2412: High severity Canonical Ubuntu Linux vulnerability
It was discovered that the AWT toolkit did not properly handle the toolkit threads. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, SE 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-0451.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 5.0u61 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 6u71 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 7u51 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 8 - Upgrade
Upgrade
Java SE Embeddedto a version that resolves this vulnerability.Fixed in 7u51
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2412?
CVE-2014-2412 is considered a high severity vulnerability due to its potential to bypass Java sandbox restrictions.
How do I fix CVE-2014-2412?
To fix CVE-2014-2412, update to the latest version of Oracle Java or the affected icedtea package as specified in the advisory.
Which software versions are affected by CVE-2014-2412?
CVE-2014-2412 affects Oracle Java SE versions 5.0u61, 6u71, 7u51, 8, and also Java SE Embedded 7u51.
Can untrusted Java applications exploit CVE-2014-2412?
Yes, untrusted Java applications or applets could exploit CVE-2014-2412 to bypass the Java sandbox restrictions.
What platforms are impacted by CVE-2014-2412?
CVE-2014-2412 impacts various platforms, including Red Hat, Ubuntu, and Debian distributions that utilize the affected Java packages.