CVE-2014-4252: Medium severity Oracle JDK vulnerability

Published Jul 15, 2014

Updated

It was discovered that the Security component did not prevent the instantiation of security services with a non-public constructor. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information.

Other sources

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Security.

Affected Software

8 affected components

Oracle JDK=1.5.0-update65

Oracle JDK=1.6.0-update75

Oracle JDK=1.7.0-update60

Oracle JDK=1.8.0-update5

ORACLE JRE=1.5.0-update65

ORACLE JRE=1.6.0-update75

ORACLE JRE=1.7.0-update60

ORACLE JRE=1.8.0-update5

Event History

Jul 15, 2014

Data Sourced

via Red Hat·07:02 AM

DescriptionSeverityAffected Software

Jul 17, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4252?

CVE-2014-4252 is rated as a moderate severity vulnerability due to potential information disclosure risks.

How do I fix CVE-2014-4252?

To fix CVE-2014-4252, upgrade to the latest version of Oracle JDK or JRE that addresses this vulnerability.

What software is affected by CVE-2014-4252?

CVE-2014-4252 affects multiple versions of Oracle JDK and JRE, including 1.5.0-update65, 1.6.0-update75, 1.7.0-update60, and 1.8.0-update5.

Can CVE-2014-4252 be exploited remotely?

Yes, CVE-2014-4252 can potentially be exploited remotely by untrusted Java applications or applets.

What are the potential impacts of CVE-2014-4252?

The potential impacts of CVE-2014-4252 include the disclosure of sensitive information from the affected systems.