CVE-2020-14583: Buffer Overflow
First published: Mon Jul 13 2020(Updated: )
An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and no availability impact.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <1.8.0-openjdk-1:1.8.0.262.b10-0.el6_10 | 1.8.0-openjdk-1:1.8.0.262.b10-0.el6_10 |
| redhat/java | <1.7.1-ibm-1:1.7.1.4.70-1jpp.1.el6_10 | 1.7.1-ibm-1:1.7.1.4.70-1jpp.1.el6_10 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.262.b10-0.el7_8 | 1.8.0-openjdk-1:1.8.0.262.b10-0.el7_8 |
| redhat/java | <11-openjdk-1:11.0.8.10-0.el7_8 | 11-openjdk-1:11.0.8.10-0.el7_8 |
| redhat/java | <1.7.1-ibm-1:1.7.1.4.70-1jpp.1.el7 | 1.7.1-ibm-1:1.7.1.4.70-1jpp.1.el7 |
| redhat/java | <1.8.0-ibm-1:1.8.0.6.20-1jpp.1.el7 | 1.8.0-ibm-1:1.8.0.6.20-1jpp.1.el7 |
| redhat/java | <11-openjdk-1:11.0.8.10-0.el8_2 | 11-openjdk-1:11.0.8.10-0.el8_2 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.262.b10-0.el8_2 | 1.8.0-openjdk-1:1.8.0.262.b10-0.el8_2 |
| redhat/java | <1.8.0-ibm-1:1.8.0.6.15-1.el8_2 | 1.8.0-ibm-1:1.8.0.6.15-1.el8_2 |
| redhat/java | <11-openjdk-1:11.0.8.10-0.el8_0 | 11-openjdk-1:11.0.8.10-0.el8_0 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.262.b10-0.el8_0 | 1.8.0-openjdk-1:1.8.0.262.b10-0.el8_0 |
| redhat/java | <11-openjdk-1:11.0.8.10-0.el8_1 | 11-openjdk-1:11.0.8.10-0.el8_1 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.262.b10-0.el8_1 | 1.8.0-openjdk-1:1.8.0.262.b10-0.el8_1 |
| Oracle OpenJDK 1.8.0 | =1.7.0-update261 | |
| Oracle OpenJDK 1.8.0 | =1.8.0-update251 | |
| Oracle OpenJDK 1.8.0 | =11.0.7 | |
| Oracle OpenJDK 1.8.0 | =14.0.1 | |
| Oracle JRE | =1.8.0-update251 | |
| Fedora | =31 | |
| Fedora | =32 | |
| Ubuntu | =16.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =20.04 | |
| Debian | =9.0 | |
| Debian | =10.0 | |
| SUSE Linux | =15.1 | |
| SUSE Linux | =15.2 | |
| NetApp 7-Mode Transition Tool | ||
| NetApp Active IQ Unified Manager | >=7.3 | |
| NetApp Active IQ Unified Manager | >=9.5 | |
| NetApp Cloud Backup | ||
| NetApp Cloud Secure Agent | ||
| NetApp E-Series Performance Analyzer | ||
| NetApp E-Series SANtricity OS Controller | >=11.0.0<=11.70.2 | |
| NetApp E-Series SANtricity Web Services | ||
| NetApp OnCommand Insight | ||
| NetApp OnCommand Workflow Automation | ||
| NetApp E-Series SANtricity Unified Manager | ||
| NetApp SnapManager for SAP | ||
| NetApp SnapManager for Oracle | ||
| NetApp SteelStore Cloud Integrated Storage | ||
| NetApp StorageGrid | >=9.0.0<=9.0.4 | |
| NetApp StorageGrid | ||
| debian/openjdk-11 | 11.0.24+8-2~deb11u1 11.0.26+4-1~deb11u1 11.0.27~4ea-1 | |
| debian/openjdk-8 | 8u442-ga-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-14583 https://nvd.nist.gov/vuln/detail/CVE-2020-14583
- https://bugzilla.redhat.com/show_bug.cgi?id=1856448
- https://access.redhat.com/errata/RHSA-2020:2985
- https://access.redhat.com/errata/RHSA-2020:3387
- https://access.redhat.com/errata/RHSA-2020:2968
- https://access.redhat.com/errata/RHSA-2020:2969
- https://access.redhat.com/errata/RHSA-2020:3388
- https://access.redhat.com/errata/RHSA-2020:5585
- https://access.redhat.com/errata/RHSA-2020:2970
- https://access.redhat.com/errata/RHSA-2020:2972
- https://access.redhat.com/errata/RHSA-2020:3386
- https://access.redhat.com/errata/RHSA-2020:3098
- https://access.redhat.com/errata/RHSA-2020:3100
- https://access.redhat.com/errata/RHSA-2020:3099
- https://access.redhat.com/errata/RHSA-2020:3101
- https://access.redhat.com/security/cve/cve-2020-14583
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.netapp.com/advisory/ntap-20200717-0005/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/
- https://www.debian.org/security/2020/dsa-4734
- https://usn.ubuntu.com/4433-1/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html
- https://usn.ubuntu.com/4453-1/
- https://security.gentoo.org/glsa/202008-24
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html
- https://security.gentoo.org/glsa/202209-15
- https://launchpad.net/bugs/cve/CVE-2020-14583
- https://www.oracle.com/security-alerts/cpujul2020.html#AppendixJAVA
- http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/fa0ca4cb69bb
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/368b6f0a21fc
- https://exchange.xforce.ibmcloud.com/vulnerabilities/185061
- https://www.ibm.com/support/pages/node/6256562 (Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/
- https://security-tracker.debian.org/tracker/CVE-2020-14583
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14583
- https://nvd.nist.gov/vuln/detail/CVE-2020-14583
- https://ubuntu.com/security/CVE-2020-14583
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2020-14583?
CVE-2020-14583 has been classified with low confidentiality impact, low integrity impact, and no availability impact.
How do I fix CVE-2020-14583?
To fix CVE-2020-14583, update to the recommended versions of the affected Java packages provided by Red Hat and other vendors.
Which software is affected by CVE-2020-14583?
CVE-2020-14583 affects various versions of Java SE, including multiple OpenJDK and IBM Java packages across different Red Hat and Debian distributions.
Can CVE-2020-14583 be exploited without authentication?
Yes, CVE-2020-14583 can be exploited by an unauthenticated attacker.
What components of Java SE are implicated in CVE-2020-14583?
The vulnerability relates specifically to the Libraries component of Java SE, affecting boundary checks in the java.nio.Buffer class.
- collector/redhat-cve
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-14583
- collector/ibm-support
- source/IBM
- agent/type
- agent/weakness
- agent/severity
- agent/remedy
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/author
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- package-manager/redhat
- package-manager/debian
- vendor/oracle
- canonical/oracle openjdk 1.8.0
- version/oracle openjdk 1.8.0/1.7.0-update261
- version/oracle openjdk 1.8.0/1.8.0-update251
- version/oracle openjdk 1.8.0/11.0.7
- version/oracle openjdk 1.8.0/14.0.1
- canonical/oracle jre
- version/oracle jre/1.8.0-update251
- vendor/fedoraproject
- canonical/fedora
- version/fedora/31
- version/fedora/32
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/20.04
- vendor/debian
- canonical/debian
- version/debian/9.0
- version/debian/10.0
- vendor/opensuse
- canonical/suse linux
- version/suse linux/15.1
- version/suse linux/15.2
- vendor/netapp
- canonical/netapp 7-mode transition tool
- canonical/netapp active iq unified manager
- version/netapp active iq unified manager/7.3
- version/netapp active iq unified manager/9.5
- canonical/netapp cloud backup
- canonical/netapp cloud secure agent
- canonical/netapp e-series performance analyzer
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0.0
- version/netapp e-series santricity os controller/11.70.2
- canonical/netapp e-series santricity web services
- canonical/netapp oncommand insight
- canonical/netapp oncommand workflow automation
- canonical/netapp e-series santricity unified manager
- canonical/netapp snapmanager for sap
- canonical/netapp snapmanager for oracle
- canonical/netapp steelstore cloud integrated storage
- canonical/netapp storagegrid
- version/netapp storagegrid/9.0.0
- version/netapp storagegrid/9.0.4