CVE-2014-4266: Medium severity Oracle JDK vulnerability

Published Jul 15, 2014

Updated

It was discovered that JavasunmanagementGcInfoBuildergetLastGcInfo0() may return unexpected values. An untrusted Java application or applet could possibly use this flaw to impact the integrity of the Java Virtual Machine.

Other sources

Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Serviceability.

Affected Software

4 affected components

Oracle JDK=1.7.0-update60

Oracle JDK=1.8.0-update5

ORACLE JRE=1.7.0-update60

ORACLE JRE=1.8.0-update5

Event History

Jul 15, 2014

Data Sourced

via Red Hat·07:04 AM

DescriptionSeverityAffected Software

Jul 17, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4266?

CVE-2014-4266 is considered a critical vulnerability affecting the integrity of the Java Virtual Machine.

How do I fix CVE-2014-4266?

To fix CVE-2014-4266, upgrade your Oracle JDK or JRE to versions 1.7.0-update61 or 1.8.0-update6 or newer.

Which Java versions are affected by CVE-2014-4266?

CVE-2014-4266 affects Oracle Java SE 7u60 and 8u5.

Can an untrusted Java application exploit CVE-2014-4266?

Yes, an untrusted Java application or applet can exploit CVE-2014-4266, impacting the integrity of the JVM.

What are the potential consequences of CVE-2014-4266?

The consequences of CVE-2014-4266 could include compromised integrity of the Java Virtual Machine, leading to security vulnerabilities.