- Vulnerability/
- REDHAT-BUG-1075795
REDHAT-BUG-1075795
First published: Wed Mar 12 2014(Updated: )
Florian Weimer discovered that AtomicReferenceFieldUpdater in OpenJDK does not properly check if the field to be updated is of primitive type. An untrusted Java application or applet could use flaw to trigger Java virtual machine memory corruption and possibly bypass Java sandbox restrictions. AtomicReferenceFieldUpdater API documentation: <a href="http://docs.oracle.com/javase/7/docs/api/java/util/concurrent/atomic/AtomicReferenceFieldUpdater.html">http://docs.oracle.com/javase/7/docs/api/java/util/concurrent/atomic/AtomicReferenceFieldUpdater.html</a> This issue is mitigated by the bug that prevents Atomic*FieldUpdater instances when code runs under security manager restrictions under OpenJDK and Oracle JDK 6 and 7. The bug was fixed in JDK8: <a href="http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7103570">http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7103570</a> <a href="http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7131655">http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7131655</a> <a href="http://hg.openjdk.java.net/jdk8/tl/jdk/rev/48513d156965">http://hg.openjdk.java.net/jdk8/tl/jdk/rev/48513d156965</a> Acknowledgement: This issue was discovered by Florian Weimer of Red Hat Product Security.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenJDK 8 | <8 | |
| Oracle JDK 6 | <8 | |
| Oracle Java 7 | <8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://docs.oracle.com/javase/7/docs/api/java/util/concurrent/atomic/AtomicReferenceFieldUpdater.html
- http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7103570
- http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7131655
- http://hg.openjdk.java.net/jdk8/tl/jdk/rev/48513d156965
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=873749&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=873749&action=edit
- https://rhn.redhat.com/errata/RHSA-2014-0890.html
- https://rhn.redhat.com/errata/RHSA-2014-0889.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-July/028550.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-July/028584.html
- http://hg.openjdk.java.net/jdk6/jdk6/jdk/rev/b298e08560f7
- http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/3bb943c6ff7d
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html#AppendixJAVA
- https://rhn.redhat.com/errata/RHSA-2014-0902.html
- https://rhn.redhat.com/errata/RHSA-2014-0908.html
- https://rhn.redhat.com/errata/RHSA-2014-0907.html
- https://rhn.redhat.com/errata/RHSA-2014-1033.html
- https://rhn.redhat.com/errata/RHSA-2014-1036.html
- https://rhn.redhat.com/errata/RHSA-2014-1042.html
- https://rhn.redhat.com/errata/RHSA-2014-1041.html
- https://rhn.redhat.com/errata/RHSA-2015-0264.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1075795
Frequently Asked Questions
What is the severity of REDHAT-BUG-1075795?
The severity of REDHAT-BUG-1075795 is critical due to the risk of memory corruption and potential bypassing of Java sandbox restrictions.
How do I fix REDHAT-BUG-1075795?
To fix REDHAT-BUG-1075795, update your OpenJDK or JDK to a version that has patched the vulnerability.
What versions are affected by REDHAT-BUG-1075795?
REDHAT-BUG-1075795 affects Oracle OpenJDK versions up to, but not including, 8, as well as Oracle JDK 6 and 7.
Can untrusted applications exploit REDHAT-BUG-1075795?
Yes, an untrusted Java application or applet can exploit REDHAT-BUG-1075795 to trigger memory corruption.
What impact does REDHAT-BUG-1075795 have on Java applications?
The impact of REDHAT-BUG-1075795 on Java applications includes potential memory corruption and the ability to escape Java's security sandbox.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-4262
- agent/severity
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/openjdk 8
- canonical/oracle jdk 6
- canonical/oracle java 7