CVE-2014-0407
published 2014-01-15CVE-2014-0407: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows…
PriorityP49low3.5CVSS 2.0
AVLACHAuSCPIPAP
EPSS
0.31%
23.0th percentile
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0405.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | virtualbox | < virtualbox 4.3.6-dfsg-1 (sid) | virtualbox 4.3.6-dfsg-1 (sid) |
| debian | virtualbox-guest-additions-iso | < virtualbox-guest-additions-iso 4.3.10-1 (bookworm) | virtualbox-guest-additions-iso 4.3.10-1 (bookworm) |
| oracle | vm_virtualbox | <= 4.1.28 | — |
| oracle | vm_virtualbox | <= 4.3.2 | — |
| oracle | vm_virtualbox | <= 3.2.18 | — |
| oracle | vm_virtualbox | <= 4.2.18 | — |
| oracle | vm_virtualbox | <= 4.0.20 | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
CVSS provenance
nvdv2.03.5LOWAV:L/AC:H/Au:S/C:P/I:P/A:P
osv3.5LOW
vendor_debian3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-247g-7x8j-8cc8: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3
ghsa_unreviewed·2022-05-17·CVSS 3.5
CVE-2014-0405 [LOW] GHSA-247g-7x8j-8cc8: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
GHSA
GHSA-9h56-55p8-xgj2: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3
ghsa_unreviewed·2022-05-17·CVSS 3.5
CVE-2014-0407 [LOW] GHSA-9h56-55p8-xgj2: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0405.
OSV
openjdk-7 vulnerabilities
osv·2015-01-28·CVSS 3.4
CVE-2014-3566 openjdk-7 vulnerabilities
openjdk-7 vulnerabilities
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity and availability. An attacker could
exploit these to cause a denial of service or expose sensitive data over
the network. (CVE-2014-3566, CVE-2014-6587, CVE-2014-6601, CVE-2015-0395,
CVE-2015-0408, CVE-2015-0412)
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure. An attacker could exploit these to expose sensitive
data over the network. (CVE-2014-6585, CVE-2014-6591, CVE-2015-0400,
CVE-2015-0407)
A vulnerability was discovered in the OpenJDK JRE related to
information disclosure and integrity. An attacker could exploit this to
expose sensitive data over the network. (CVE-2014-6593)
A vulnerability was discovere
OSV
CVE-2014-0405: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3
osv·2014-01-15·CVSS 3.5
CVE-2014-0405 [LOW] CVE-2014-0405: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
OSV
CVE-2014-0407: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3
osv·2014-01-15·CVSS 3.5
CVE-2014-0407 [LOW] CVE-2014-0407: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0405.
Debian
CVE-2014-0405: virtualbox-guest-additions-iso - Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtua...
vendor_debian·2014·CVSS 3.5
CVE-2014-0405 [LOW] CVE-2014-0405: virtualbox-guest-additions-iso - Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtua...
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
Scope: local
bookworm: resolved (fixed in 4.3.10-1)
bullseye: resolved (fixed in 4.3.10-1)
forky: resolved (fixed in 4.3.10-1)
sid: resolved (fixed in 4.3.10-1)
trixie: resolved (fixed in 4.3.10-1)
Debian
CVE-2014-0407: virtualbox - Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtua...
vendor_debian·2014·CVSS 3.5
CVE-2014-0407 [LOW] CVE-2014-0407: virtualbox - Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtua...
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0405.
Scope: local
sid: resolved (fixed in 4.3.6-dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0460 OpenJDK: missing randomization of JNDI DNS client query IDs (JNDI, 8030731)
bugzilla·2014-04-14·CVSS 5.8
CVE-2014-0460 [MEDIUM] CVE-2014-0460 OpenJDK: missing randomization of JNDI DNS client query IDs (JNDI, 8030731)
CVE-2014-0460 OpenJDK: missing randomization of JNDI DNS client query IDs (JNDI, 8030731)
It was discovered that the JNDI DNS client did not properly randomize
the DNS query ID. A remote attacker could exploit this flaw to e.g.
perfom DNS spoofing attacks.
Discussion:
Fixed now in Oracle Java SE 5.0u75, 6u75, 7u55 and 8u5 via Oracle Critical Patch Update Advisory - April 2014.
Fixed in IcedTea6 1.13.3 and IcedTea7 2.4.7:
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-April/027214.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-April/027222.html
External References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2014:0407
Bugzilla
CVE-2014-2402 OpenJDK: Incorrect NIO channel separation (Libraries, 8026716)
bugzilla·2014-04-14·CVSS 7.5
CVE-2014-2402 [HIGH] CVE-2014-2402 OpenJDK: Incorrect NIO channel separation (Libraries, 8026716)
CVE-2014-2402 OpenJDK: Incorrect NIO channel separation (Libraries, 8026716)
It was discovered that NIO channels were not properly separated across
threads. An untrusted Java application or applet could possibly use this
flaw to bypass Java sandbox restrictions.
Discussion:
Fixed now in Oracle Java SE 7u55 and 8u5 via Oracle Critical Patch Update Advisory - April 2014.
Fixed in IcedTea7 2.4.7:
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-April/027222.html
External References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2014:0407 https://rhn.redhat.com/errata/RHSA-2014-0407.html
---
This issue has been addressed in following produ
Bugzilla
CVE-2014-0455 OpenJDK: MethodHandle variable argument lists handling (Libraries, 8029844)
bugzilla·2014-04-14·CVSS 9.3
CVE-2014-0455 [CRITICAL] CVE-2014-0455 OpenJDK: MethodHandle variable argument lists handling (Libraries, 8029844)
CVE-2014-0455 OpenJDK: MethodHandle variable argument lists handling (Libraries, 8029844)
It was discovered that MethodHandle did not properly handle variable
argument lists when permuting or dropping arguments. An untrusted Java
application or applet could possibly use this flaw to bypass Java
sandbox restrictions.
Discussion:
Fixed now in Oracle Java SE 7u55 and 8u5 via Oracle Critical Patch Update Advisory - April 2014.
Fixed in IcedTea7 2.4.7:
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-April/027222.html
External References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2014:0407 https://rhn.redhat.com/errata/RHSA-2014-0407.html
Bugzilla
CVE-2014-2413 OpenJDK: method handle call hierachy bypass (Libraries, 8032686)
bugzilla·2014-04-14·CVSS 4.3
CVE-2014-2413 [MEDIUM] CVE-2014-2413 OpenJDK: method handle call hierachy bypass (Libraries, 8032686)
CVE-2014-2413 OpenJDK: method handle call hierachy bypass (Libraries, 8032686)
It was discovered that direct method handles are not properly protected
against a certain use case. An untrusted Java application or applet
could possibly use this flaw to bypass call hierachies.
Discussion:
Fixed now in Oracle Java SE 7u55 and 8u5 via Oracle Critical Patch Update Advisory - April 2014.
Fixed in IcedTea7 2.4.7:
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-April/027222.html
External References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2014:0407 https://rhn.redhat.com/errata/RHSA-2014-0407.html
---
This issue has been addressed in fol
http://osvdb.org/102058http://secunia.com/advisories/56490http://www.debian.org/security/2014/dsa-2878http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlhttp://www.securityfocus.com/bid/64758http://www.securityfocus.com/bid/64913http://www.securitytracker.com/id/1029610https://exchange.xforce.ibmcloud.com/vulnerabilities/90369http://osvdb.org/102058http://secunia.com/advisories/56490http://www.debian.org/security/2014/dsa-2878http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlhttp://www.securityfocus.com/bid/64758http://www.securityfocus.com/bid/64913http://www.securitytracker.com/id/1029610https://exchange.xforce.ibmcloud.com/vulnerabilities/90369
2014-01-15
Published