PT-2020-3592 · Oracle+5 · Java Se+6

Published 2020-07-14 · Updated 2026-05-08 · CVE-2020-14562

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Java SE versions 11.0.7 and 14.0.1

Description The issue is related to insufficient input validation in the ImageIO component of Oracle Java SE, allowing a remote attacker to cause a partial denial of service via multiple protocols. This vulnerability applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security. It does not apply to Java deployments that load and run only trusted code, typically in servers.

Recommendations For Java SE version 11.0.7, update to a version that includes the fix for this issue. For Java SE version 14.0.1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the ImageIO component until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-03926

BIT-JAVA-2020-14562

BIT-JAVA-MIN-2020-14562

BIT-JRE-2020-14562

CESA-2020_2969

CESA-2020_2970

CVE-2020-14562

DSA-4734-1

OESA-2024-2485

OESA-2024-2486

OESA-2024-2487

OESA-2024-2488

OESA-2024-2489

OPENSUSE-SU-2020:1175-1

OPENSUSE-SU-2020:1191-1

OPENSUSE-SU-2020_1175-1

OPENSUSE-SU-2020_1191-1

OPENSUSE-SU-2024:10871-1

OPENSUSE-SU-2024:10872-1

OPENSUSE-SU-2024:10873-1

RHSA-2020:2969

RHSA-2020:2970

RHSA-2020:3098

RHSA-2020:3099

RHSA-2020_2969

RHSA-2020_2970

SUSE-SU-2020:2008-1

SUSE-SU-2020:2143-1

USN-4433-1

Affected Products

Centos

Java Platform

Java Se

Linuxmint

Red Hat

Suse

Ubuntu

References · 195

• https://nvd.nist.gov/vuln/detail/CVE-2024-21217 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-14562 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jre-2020-14562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14562 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21012 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14578 · Security Note
• https://debian.org/security/2020/dsa-4734 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21144 · Security Note
• https://ubuntu.com/security/CVE-2020-14593 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1175-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-java-min-2020-14562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21068 · Security Note