Executive Summary

Informations
Name CVE-2014-0423 First vendor Publication 2014-01-15
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:N/A:P)
Cvss Base Score 5.5 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:21979
 
Oval ID: oval:org.mitre.oval:def:21979
Title: Vulnerability in Java SE 5.0u55, Java SE 6u65, Java SE 7u45, JRockit R27.7.7, JRockit R28.2.9 and Java SE Embedded 7u45 component of Oracle Java SE (subcomponent: Beans)
Description: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.
Family: windows Class: vulnerability
Reference(s): CVE-2014-0423
 Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
 Product(s): Java Runtime Environment
JRockit
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23695
 
Oval ID: oval:org.mitre.oval:def:23695
Title: USN-2124-1 -- openjdk-6 vulnerabilities
Description: Several security issues were fixed in OpenJDK 6.
Family: unix Class: patch
Reference(s): USN-2124-1
CVE-2014-0411
CVE-2013-5878
CVE-2013-5907
CVE-2014-0373
CVE-2014-0422
CVE-2014-0428
CVE-2013-5884
CVE-2014-0368
CVE-2013-5896
CVE-2013-5910
CVE-2014-0376
CVE-2014-0416
CVE-2014-0423
 Version: 5
Platform(s): Ubuntu 12.04
Ubuntu 10.04
 Product(s): openjdk-6
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24653
 
Oval ID: oval:org.mitre.oval:def:24653
Title: USN-2124-2 -- openjdk-6 regression
Description: USN-2124-1 introduced a regression in OpenJDK 6.
Family: unix Class: patch
Reference(s): USN-2124-2
CVE-2014-0411
CVE-2013-5878
CVE-2013-5907
CVE-2014-0373
CVE-2014-0422
CVE-2014-0428
CVE-2013-5884
CVE-2014-0368
CVE-2013-5896
CVE-2013-5910
CVE-2014-0376
CVE-2014-0416
CVE-2014-0423
 Version: 5
Platform(s): Ubuntu 12.04
Ubuntu 10.04
 Product(s): openjdk-6
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2
Application 3
Application 2

Information Assurance Vulnerability Management (IAVM)

Date Description
2014-01-16 IAVM : 2014-A-0010 - Multiple Vulnerabilities in Oracle Java SE
Severity : Category I - VMSKEY : V0043398

Nessus® Vulnerability Scanner

Date Description
2014-12-22 Name : The remote device is affected by multiple vulnerabilities.
File : juniper_space_jsa10659.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0982.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0414.nasl - Type : ACT_GATHER_INFO
2014-08-22 Name : The remote host is affected by multiple vulnerabilities.
File : juniper_nsm_jsa10642.nasl - Type : ACT_GATHER_INFO
2014-07-30 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0705.nasl - Type : ACT_GATHER_INFO
2014-07-28 Name : The remote AIX host has a version of Java SDK installed that is potentially a...
File : aix_java_jan2014_advisory.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-96.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-95.nasl - Type : ACT_GATHER_INFO
2014-05-12 Name : The remote host has software installed that is affected by multiple vulnerabi...
File : lotus_notes_9_0_1_fp1.nasl - Type : ACT_GATHER_INFO
2014-05-12 Name : The remote server is affected by multiple vulnerabilities.
File : domino_9_0_1_fp1.nasl - Type : ACT_GATHER_INFO
2014-05-12 Name : The remote host has software installed that is affected by multiple vulnerabi...
File : lotus_domino_9_0_1_fp1.nasl - Type : ACT_GATHER_INFO
2014-04-08 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2124-2.nasl - Type : ACT_GATHER_INFO
2014-02-28 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2124-1.nasl - Type : ACT_GATHER_INFO
2014-02-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_6_0-ibm-140213.nasl - Type : ACT_GATHER_INFO
2014-02-18 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_7_0-ibm-140206.nasl - Type : ACT_GATHER_INFO
2014-02-11 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_7_0-openjdk-140205.nasl - Type : ACT_GATHER_INFO
2014-02-05 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-283.nasl - Type : ACT_GATHER_INFO
2014-02-05 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0136.nasl - Type : ACT_GATHER_INFO
2014-02-05 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-280.nasl - Type : ACT_GATHER_INFO
2014-02-05 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0135.nasl - Type : ACT_GATHER_INFO
2014-02-05 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0134.nasl - Type : ACT_GATHER_INFO
2014-01-28 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0097.nasl - Type : ACT_GATHER_INFO
2014-01-28 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-0097.nasl - Type : ACT_GATHER_INFO
2014-01-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0097.nasl - Type : ACT_GATHER_INFO
2014-01-28 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140127_java_1_6_0_openjdk_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-01-27 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201401-30.nasl - Type : ACT_GATHER_INFO
2014-01-24 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2089-1.nasl - Type : ACT_GATHER_INFO
2014-01-21 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-011.nasl - Type : ACT_GATHER_INFO
2014-01-16 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0030.nasl - Type : ACT_GATHER_INFO
2014-01-16 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0027.nasl - Type : ACT_GATHER_INFO
2014-01-16 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0026.nasl - Type : ACT_GATHER_INFO
2014-01-16 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140115_java_1_7_0_openjdk_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-01-16 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-0027.nasl - Type : ACT_GATHER_INFO
2014-01-16 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-0026.nasl - Type : ACT_GATHER_INFO
2014-01-16 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140115_java_1_7_0_openjdk_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-01-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0027.nasl - Type : ACT_GATHER_INFO
2014-01-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0026.nasl - Type : ACT_GATHER_INFO
2014-01-15 Name : The remote Unix host contains a programming platform that is potentially affe...
File : oracle_java_cpu_jan_2014_unix.nasl - Type : ACT_GATHER_INFO
2014-01-15 Name : The remote Windows host contains a programming platform that is potentially a...
File : oracle_java_cpu_jan_2014.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/995b32f013f5
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html
http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html
http://marc.info/?l=bugtraq&m=139402697611681&w=2
http://marc.info/?l=bugtraq&m=139402697611681&w=2
http://marc.info/?l=bugtraq&m=139402749111889&w=2
http://marc.info/?l=bugtraq&m=139402749111889&w=2
http://rhn.redhat.com/errata/RHSA-2014-0026.html
http://rhn.redhat.com/errata/RHSA-2014-0027.html
http://rhn.redhat.com/errata/RHSA-2014-0030.html
http://rhn.redhat.com/errata/RHSA-2014-0097.html
http://rhn.redhat.com/errata/RHSA-2014-0134.html
http://rhn.redhat.com/errata/RHSA-2014-0135.html
http://rhn.redhat.com/errata/RHSA-2014-0136.html
http://secunia.com/advisories/56432
http://secunia.com/advisories/56485
http://secunia.com/advisories/56486
http://secunia.com/advisories/56487
http://secunia.com/advisories/56535
http://secunia.com/advisories/59283
http://secunia.com/advisories/60568
http://www-01.ibm.com/support/docview.wss?uid=swg21677388
http://www-01.ibm.com/support/docview.wss?uid=swg21679287
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
http://www.securityfocus.com/bid/64758
http://www.securityfocus.com/bid/64914
http://www.securitytracker.com/id/1029608
http://www.ubuntu.com/usn/USN-2089-1
http://www.ubuntu.com/usn/USN-2124-1
https://access.redhat.com/errata/RHSA-2014:0414
https://bugzilla.redhat.com/show_bug.cgi?id=1053066
https://exchange.xforce.ibmcloud.com/vulnerabilities/90340
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n...
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
Date Informations
2024-11-28 12:38:36
  • Multiple Updates
2022-05-13 21:27:54
  • Multiple Updates
2021-05-04 12:29:33
  • Multiple Updates
2021-04-22 01:35:47
  • Multiple Updates
2020-09-08 17:22:41
  • Multiple Updates
2020-05-23 00:39:28
  • Multiple Updates
2019-03-18 12:02:24
  • Multiple Updates
2018-01-05 09:23:20
  • Multiple Updates
2017-08-29 09:24:25
  • Multiple Updates
2017-01-07 09:25:18
  • Multiple Updates
2016-09-27 09:23:18
  • Multiple Updates
2016-04-27 00:05:35
  • Multiple Updates
2014-12-23 13:26:28
  • Multiple Updates
2014-11-08 13:31:34
  • Multiple Updates
2014-08-23 13:27:41
  • Multiple Updates
2014-07-31 13:25:09
  • Multiple Updates
2014-07-29 13:25:35
  • Multiple Updates
2014-06-14 13:36:55
  • Multiple Updates
2014-05-13 13:25:11
  • Multiple Updates
2014-04-09 13:22:22
  • Multiple Updates
2014-04-01 14:40:48
  • Multiple Updates
2014-03-18 13:23:52
  • Multiple Updates
2014-03-06 13:24:40
  • Multiple Updates
2014-03-01 13:20:59
  • Multiple Updates
2014-02-26 13:21:20
  • Multiple Updates
2014-02-19 13:21:55
  • Multiple Updates
2014-02-17 11:25:00
  • Multiple Updates
2014-02-07 13:21:34
  • Multiple Updates
2014-01-23 21:21:38
  • Multiple Updates
2014-01-18 00:18:42
  • Multiple Updates
2014-01-17 13:20:37
  • Multiple Updates
2014-01-16 21:21:02
  • Multiple Updates
2014-01-15 21:22:40
  • First insertion