CVE-2014-2414: High severity Canonical Ubuntu Linux vulnerability
It was discovered that JAXB incorrectly cached certain data initialized via thread context class loaders. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 6u71 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 7u51 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 8 - Upgrade
Upgrade
Java SE Embeddedto a version that resolves this vulnerability.Fixed in 7u51
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2414?
CVE-2014-2414 is classified as a high severity vulnerability that can potentially allow untrusted Java applications to bypass sandbox restrictions.
How do I fix CVE-2014-2414?
To mitigate CVE-2014-2414, upgrade to patched versions of affected software, such as IcedTea 1.13.3 or 2.4.7, or update your Oracle JDK/JRE to the latest version.
Which software is affected by CVE-2014-2414?
CVE-2014-2414 affects various versions of Oracle Java SE, Oracle JDK, IcedTea, and specific Debian and Ubuntu Linux distributions.
Can CVE-2014-2414 impact all Java applications?
No, CVE-2014-2414 specifically impacts applications that rely on JAXB and use thread context class loaders to cache data.
What is the potential impact of exploiting CVE-2014-2414?
Exploiting CVE-2014-2414 could allow an attacker to execute malicious code outside of the Java security sandbox, compromising system security.