CVE-2014-2413: Medium severity Canonical Ubuntu Linux vulnerability
It was discovered that direct method handles are not properly protected against a certain use case. An untrusted Java application or applet could possibly use this flaw to bypass call hierachies.
Other sources
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Libraries.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2413?
CVE-2014-2413 is considered a moderate severity vulnerability allowing potential bypass of call hierarchies in Java applications.
How do I fix CVE-2014-2413?
To fix CVE-2014-2413, update your Oracle Java SE and JRE to the latest versions or apply the relevant patches provided by your operating system vendor.
Which versions are affected by CVE-2014-2413?
CVE-2014-2413 affects Oracle Java SE 7u51, 8, and several versions within Oracle's JDK and JRE, as well as related packages in various Linux distributions.
Can CVE-2014-2413 be exploited remotely?
Yes, CVE-2014-2413 can potentially be exploited remotely by untrusted Java applications or applets.
What products are impacted by CVE-2014-2413?
Products impacted by CVE-2014-2413 include Oracle JDK, Oracle JRE, as well as IcedTea packages on specific Linux distributions.