CVE-2014-2490 — Use of Externally-Controlled Format String in Oracle JDK

CWE-134 — Use of Externally-Controlled Format String12 documents7 sources

Severity

9.3CRITICALNVD

EPSS

3.5%

top 12.33%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Debian Linux HP Hp-ux Oracle JDK +1 more

Timeline

PublishedJul 17

Latest updateMay 13

Description

Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶NVDoracle/jdk1.7.0, 1.8.0+1

▶NVDoracle/jre1.7.0, 1.8.0+1

▶NVDhp/hp-uxb.11.23, b.11.31+1

Also affects: Debian Linux 7.0

🔴Vulnerability Details

GHSA

GHSA-5vjw-xx6j-g68j: Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and↗2022-05-13

▶

OSV

openjdk-7 update↗2014-09-17

▶

OSV

openjdk-7 regression↗2014-08-26

▶

OSV

openjdk-7 vulnerabilities↗2014-08-20

▶

CVEList

CVE-2014-2490: Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and↗2014-07-17

▶

📋Vendor Advisories

Ubuntu

OpenJDK 7 vulnerabilities↗2014-08-20

▶

Ubuntu

OpenJDK 6 vulnerabilities↗2014-08-12

▶

Red Hat

OpenJDK: Event logger format string vulnerability (Hotspot, 8037076)↗2014-07-15

▶

💬Community

Bugzilla

CVE-2014-2490 OpenJDK: Event logger format string vulnerability (Hotspot, 8037076)↗2014-07-15

▶