CVE-2014-4219: Critical severity Oracle JDK vulnerability

Published Jul 15, 2014

Updated

It was discovered that the bytecode verification did not properly prevent ctor calls to this() and super() from certain code constructs. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

Other sources

Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

Affected Software

6 affected components

Oracle JDK=1.6.0-update75

Oracle JDK=1.7.0-update60

Oracle JDK=1.8.0-update5

ORACLE JRE=1.6.0-update75

ORACLE JRE=1.7.0-update60

ORACLE JRE=1.8.0-update5

Event History

Jul 15, 2014

Data Sourced

via Red Hat·06:32 AM

DescriptionSeverityAffected Software

Jul 17, 2014

CVE Published

via MITRE·02:36 AM

Data Sourced

via MITRE·02:36 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4219?

CVE-2014-4219 has a high severity rating as it allows untrusted Java applications to bypass sandbox restrictions.

How do I fix CVE-2014-4219?

To fix CVE-2014-4219, update to the latest version of Oracle Java SE or apply the relevant security patches provided by Oracle.

Which software is affected by CVE-2014-4219?

CVE-2014-4219 affects multiple versions of Oracle JDK and JRE, specifically versions 1.6.0-update75, 1.7.0-update60, and 1.8.0-update5.

What type of vulnerability is CVE-2014-4219?

CVE-2014-4219 is a code execution vulnerability that arises due to improper bytecode verification in Java.

Can I run untrusted Java applications without risk after patching CVE-2014-4219?

Even after patching CVE-2014-4219, it is advisable to avoid running untrusted Java applications to minimize security risks.