5
CVSSv2

CVE-2014-0376

Published: 15/01/2014 Updated: 13/05/2022
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Summary

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote malicious users to affect integrity via vectors related to JAXP. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an improper check for "code permissions when creating document builder factories."

Vulnerable Product Search on Vulmon Subscribe to Product

oracle jre 1.7.0

oracle jdk 1.7.0

oracle jdk 1.6.0

oracle jre 1.6.0

oracle jdk 1.5.0

oracle jre 1.5.0

Vendor Advisories

Several security issues were fixed in OpenJDK 7 ...
Several security issues were fixed in OpenJDK 6 ...
USN-2124-1 introduced a regression in OpenJDK 6 ...
Synopsis Important: java-160-openjdk security update Type/Severity Security Advisory: Important Topic Updated java-160-openjdk packages that fix various security issues arenow available for Red Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as havingimportant secur ...
Synopsis Important: java-170-openjdk security update Type/Severity Security Advisory: Important Topic Updated java-170-openjdk packages that fix various security issues arenow available for Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security im ...
Synopsis Critical: java-160-ibm security update Type/Severity Security Advisory: Critical Topic Updated java-160-ibm packages that fix several security issues are nowavailable for Red Hat Enterprise Linux 5 and 6 SupplementaryThe Red Hat Security Response Team has rated this update as having criticalse ...
Synopsis Critical: java-170-oracle security update Type/Severity Security Advisory: Critical Topic Updated java-170-oracle packages that fix several security issues are nowavailable for Red Hat Enterprise Linux 5 and 6 SupplementaryThe Red Hat Security Response Team has rated this update as having crit ...
Synopsis Critical: java-170-ibm security update Type/Severity Security Advisory: Critical Topic Updated java-170-ibm packages that fix several security issues are nowavailable for Red Hat Enterprise Linux 5 and 6 SupplementaryThe Red Hat Security Response Team has rated this update as having criticalse ...
Synopsis Critical: java-170-openjdk security update Type/Severity Security Advisory: Critical Topic Updated java-170-openjdk packages that fix various security issues arenow available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having criticalsecurity impac ...
Synopsis Important: java-150-ibm security update Type/Severity Security Advisory: Important Topic Updated java-150-ibm packages that fix several security issues are nowavailable for Red Hat Enterprise Linux 5 and 6 SupplementaryThe Red Hat Security Response Team has rated this update as havingimportant ...
An input validation flaw was discovered in the font layout engine in the 2D component A specially crafted font file could trigger a Java Virtual Machine memory corruption when processed An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions (CVE-2013-5907) Multiple improper permission check issue ...
An input validation flaw was discovered in the font layout engine in the 2D component A specially crafted font file could trigger Java Virtual Machine memory corruption when processed An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions (CVE-2013-5907) Multiple improper permission check issues ...
Unspecified vulnerability in Oracle Java SE 50u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP NOTE: the previous information is from the January 2014 CPU Oracle has not commented on third-party claims that the issue is related to an improper check for "code permis ...

References

NVD-CWE-noinfohttp://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlhttp://www.securityfocus.com/bid/64758http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/783ceae9b736http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/42be8e6266abhttps://bugzilla.redhat.com/show_bug.cgi?id=1051923http://www.securitytracker.com/id/1029608http://www.securityfocus.com/bid/64907http://osvdb.org/102018http://secunia.com/advisories/56535http://secunia.com/advisories/56485http://secunia.com/advisories/56432http://secunia.com/advisories/56486http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.htmlhttp://www.ubuntu.com/usn/USN-2089-1http://rhn.redhat.com/errata/RHSA-2014-0097.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.htmlhttp://lists.opensuse.org/opensuse-updates/2014-01/msg00105.htmlhttp://www.ubuntu.com/usn/USN-2124-1http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0136.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0134.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0027.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0026.htmlhttp://lists.opensuse.org/opensuse-updates/2014-02/msg00000.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0135.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0030.htmlhttp://marc.info/?l=bugtraq&m=139402697611681&w=2http://marc.info/?l=bugtraq&m=139402749111889&w=2http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.htmlhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777https://exchange.xforce.ibmcloud.com/vulnerabilities/90350https://access.redhat.com/errata/RHSA-2014:0414https://nvd.nist.govhttps://usn.ubuntu.com/2089-1/https://access.redhat.com/security/cve/cve-2014-0376