CVE-2014-8873 — Improper Input Validation in Oracle Openjdk

CWE-20 — Improper Input Validation4 documents4 sources
Severity
10.0CRITICALNVD
EPSS
10.0%
top 6.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Oracle Openjdk
Timeline
PublishedNov 9
Latest updateMay 17

Description

A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages1 packages

▶NVDoracle/openjdk1.7.0

🔴Vulnerability Details

2
GHSA
GHSA-8crp-v9pf-hp45: A↗2022-05-17
▶
CVEList
CVE-2014-8873: A↗2015-11-09
▶

📋Vendor Advisories

1
Debian
CVE-2014-8873: openjdk-8 - A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a M...↗2014
▶
CVE-2014-8873 — Improper Input Validation in Oracle | cvebase