CVE-2014-6468
published 2014-10-15CVE-2014-6468: Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to…
PriorityP430medium6.8CVSS 2.0
AVNACLAuSCNINAC
EPSS
2.71%
84.3th percentile
Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openjdk-8 | < openjdk-8 8u40~b09-1 (sid) | openjdk-8 8u40~b09-1 (sid) |
| oracle | jdk | — | — |
| oracle | jre | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:C
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fx6v-47q8-469f: Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related
ghsa_unreviewed·2022-05-13
CVE-2014-6468 [MEDIUM] GHSA-fx6v-47q8-469f: Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related
Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Red Hat
OpenJDK: insufficient SharedArchiveFile checks (Hotspot, 8044269)
vendor_redhat·2014-10-14·CVSS 6.8
CVE-2014-6468 [MEDIUM] OpenJDK: insufficient SharedArchiveFile checks (Hotspot, 8044269)
OpenJDK: insufficient SharedArchiveFile checks (Hotspot, 8044269)
Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
It was discovered that the Hotspot component in OpenJDK failed to properly handle malformed Shared Archive files. A local attacker able to modify a Shared Archive file used by a virtual machine of a different user could possibly use this flaw to escalate their privileges.
Package: java-1.6.0-openjdk (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.6.0-sun (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.7.0-openjdk (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.7.0-oracle (Red Hat Enterprise Linux 5) - Not affected
Package:
Debian
CVE-2014-6468: openjdk-8 - Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect co...
vendor_debian·2014·CVSS 6.8
CVE-2014-6468 [MEDIUM] CVE-2014-6468: openjdk-8 - Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect co...
Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Scope: local
sid: resolved (fixed in 8u40~b09-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-6468 OpenJDK: insufficient SharedArchiveFile checks (Hotspot, 8044269)
bugzilla·2014-10-13·CVSS 6.8
CVE-2014-6468 [MEDIUM] CVE-2014-6468 OpenJDK: insufficient SharedArchiveFile checks (Hotspot, 8044269)
CVE-2014-6468 OpenJDK: insufficient SharedArchiveFile checks (Hotspot, 8044269)
It was discovered that the Hotspot component in OpenJDK failed to properly check the format of a loaded SharedArchiveFile. If a JVM was instructed to load untrusted SharedArchiveFile, it could cause JVM to execute arbitrary code.
OpenJDK versions 6 and 7 only load shared archive that is distributed with JDK and the file path is hard-coded in JVM. OpenJDK 8 allows alternate shared archive file name to be specified using the -XX:SharedArchiveFile= command line option.
Discussion:
Public now via Oracle Critical Patch Update - October 2014. Fixed in Oracle Java SE 8u25.
External References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA
---
This issue has been address
Bugzilla
CVE-2013-6468 Drools: Remote Java Code Execution in MVEL
bugzilla·2014-01-09·CVSS 6.5
CVE-2013-6468 [MEDIUM] CVE-2013-6468 Drools: Remote Java Code Execution in MVEL
CVE-2013-6468 Drools: Remote Java Code Execution in MVEL
A code execution vulnerability has been discovered in Drools. The flaw allows remote authenticated attackers to submit arbitrary Java code in MVEL or Drools expressions, the code would be executed within the security context of the application server.
Discussion:
This issue has been addressed in following products:
Red Hat JBoss BPM Suite 6.0.1
Via RHSA-2014:0371 https://rhn.redhat.com/errata/RHSA-2014-0371.html
---
This issue has been addressed in following products:
Red Hat JBoss BRMS 6.0.1
Via RHSA-2014:0372 https://rhn.redhat.com/errata/RHSA-2014-0372.html
http://linux.oracle.com/errata/ELSA-2014-1636http://rhn.redhat.com/errata/RHSA-2014-1636.htmlhttp://secunia.com/advisories/60416http://secunia.com/advisories/61609http://secunia.com/advisories/61928http://security.gentoo.org/glsa/glsa-201502-12.xmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21692299http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlhttp://www.securityfocus.com/bid/70488http://linux.oracle.com/errata/ELSA-2014-1636http://rhn.redhat.com/errata/RHSA-2014-1636.htmlhttp://secunia.com/advisories/60416http://secunia.com/advisories/61609http://secunia.com/advisories/61928http://security.gentoo.org/glsa/glsa-201502-12.xmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21692299http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlhttp://www.securityfocus.com/bid/70488
2014-10-15
Published