CVE-2014-2423: High severity Canonical Ubuntu Linux vulnerability
It was discovered that JAXWS incorrectly cached certain data initialized via thread context class loaders. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-0458.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.3 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What are the potential impacts of CVE-2014-2423?
CVE-2014-2423 allows untrusted Java applications or applets to bypass Java sandbox restrictions, potentially compromising security.
How can I mitigate the risk associated with CVE-2014-2423?
To mitigate CVE-2014-2423, users should upgrade to versions of Oracle Java SE that are patched against this vulnerability.
What versions of Oracle Java SE are affected by CVE-2014-2423?
CVE-2014-2423 affects Oracle Java SE versions 6u71, 7u51, and 8, along with Java SE Embedded versions.
Is there a patch available for CVE-2014-2423?
Yes, patches are available for affected Oracle Java SE and related software versions; upgrading to the latest version will resolve this issue.
What should I do if I am using an affected version of Java according to CVE-2014-2423?
If you're using an affected version of Java, it is crucial to update to the recommended versions immediately to prevent exploitation.