PT-2015-3051 · Oracle · Openjdk

Published 2015-04-24 · Updated 2015-11-10 · CVE-2014-8873

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenJDK versions 7u79-2.5.5-1~deb8u1

Description The issue is related to a .desktop file in the OpenJDK package, which includes a MIME type registration added to /etc/mailcap. This allows remote attackers to execute arbitrary code via a JAR file.

Recommendations For OpenJDK version 7u79-2.5.5-1~deb8u1, consider removing the MIME type registration from /etc/mailcap to prevent exploitation until a patch is available. As a temporary workaround, restrict the execution of JAR files to minimize the risk of arbitrary code execution.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00256

CVE-2014-8873

DSA-3235-1

DSA-3316-1

Affected Products

Openjdk

References · 60

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0470 · Security Note
• http://debian.org/security/2015/dsa-3235 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2632 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2613 · Security Note
• https://bdu.fstec.ru/vul/2015-09950 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0460 · Security Note
• https://bdu.fstec.ru/vul/2015-11042 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4733 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3316-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4749 · Security Note
• https://bdu.fstec.ru/vul/2015-09962 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2625 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0477 · Security Note
• https://bdu.fstec.ru/vul/2015-09959 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0469 · Security Note