PT-2014-1257 · Oracle+6 · Oracle Java Se+9
Tomas Hoger
·
Published
2014-01-15
·
Updated
2024-06-15
·
CVE-2014-0423
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Oracle Java SE versions 5.0u55, 6u65, and 7u45
JRockit versions R27.7.7 and R28.2.9
Java SE Embedded version 7u45
OpenJDK version 7
Description
The issue allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. It is reportedly an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding, although Oracle has not commented on this. The vulnerability can be exploited by a remote attacker to disrupt confidentiality and integrity of data using the Beans component.
Recommendations
For Oracle Java SE versions 5.0u55, 6u65, and 7u45, update to a version that is not affected by this issue.
For JRockit versions R27.7.7 and R28.2.9, update to a version that is not affected by this issue.
For Java SE Embedded version 7u45, update to a version that is not affected by this issue.
For OpenJDK version 7, update to a version that is not affected by this issue.
As a temporary workaround, consider disabling the Beans component until a patch is available.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Hp-Ux
Ibm Aix
Jrockit
Java Platform
Java Se Embedded
Openjdk
Oracle Java Se
Red Hat
Suse