{"id":"MGASA-2014-0189","summary":"Updated java-1.7.0-openjdk packages fix multiple security vulnerabilities","details":"Updated java-1.7.0-openjdk packages fix security vulnerabilities:\n\nAn input validation flaw was discovered in the medialib library in the 2D\ncomponent. A specially crafted image could trigger Java Virtual Machine\nmemory corruption when processed. A remote attacker, or an untrusted Java\napplication or applet, could possibly use this flaw to execute arbitrary\ncode with the privileges of the user running the Java Virtual Machine\n(CVE-2014-0429).\n\nMultiple flaws were discovered in the Hotspot and 2D components in OpenJDK.\nAn untrusted Java application or applet could use these flaws to trigger\nJava Virtual Machine memory corruption and possibly bypass Java sandbox\nrestrictions (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421).\n\nMultiple improper permission check issues were discovered in the Libraries\ncomponent in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass Java sandbox restrictions (CVE-2014-0457,\nCVE-2014-0455, CVE-2014-0461).\n\nMultiple improper permission check issues were discovered in the AWT,\nJAX-WS, JAXB, Libraries, Security, Sound, and 2D components in OpenJDK.\nAn untrusted Java application or applet could use these flaws to bypass\ncertain Java sandbox restrictions (CVE-2014-2412, CVE-2014-0451,\nCVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-2402,\nCVE-2014-0446, CVE-2014-2413, CVE-2014-0454, CVE-2014-2427, CVE-2014-0459).\n\nMultiple flaws were identified in the Java Naming and Directory Interface\n(JNDI) DNS client. These flaws could make it easier for a remote attacker\nto perform DNS spoofing attacks (CVE-2014-0460).\n\nIt was discovered that the JAXP component did not properly prevent access\nto arbitrary files when a SecurityManager was present. This flaw could\ncause a Java application using JAXP to leak sensitive information, or\naffect application availability (CVE-2014-2403).\n\nIt was discovered that the Security component in OpenJDK could leak some\ntiming information when performing PKCS#1 unpadding. This could possibly\nlead to the disclosure of some information that was meant to be protected\nby encryption (CVE-2014-0453).\n\nIt was discovered that the fix for CVE-2013-5797 did not properly resolve\ninput sanitization flaws in javadoc. When javadoc documentation was\ngenerated from an untrusted Java source code and hosted on a domain not\ncontrolled by the code author, these issues could make it easier to perform\ncross-site scripting (XSS) attacks (CVE-2014-2398).\n\nAn insecure temporary file use flaw was found in the way the unpack200\nutility created log files. A local attacker could possibly use this flaw to\nperform a symbolic link attack and overwrite arbitrary files with the\nprivileges of the user running unpack200 (CVE-2014-1876).\n\nNote that the CVE-2014-0459 issue is in the lcms2 library, which has been\npatched to correct this flaw.\n","modified":"2026-04-16T06:24:27.533198624Z","published":"2014-04-23T16:13:53Z","upstream":["CVE-2014-0429","CVE-2014-0446","CVE-2014-0451","CVE-2014-0452","CVE-2014-0453","CVE-2014-0454","CVE-2014-0455","CVE-2014-0456","CVE-2014-0457","CVE-2014-0458","CVE-2014-0459","CVE-2014-0460","CVE-2014-0461","CVE-2014-1876","CVE-2014-2397","CVE-2014-2398","CVE-2014-2402","CVE-2014-2403","CVE-2014-2412","CVE-2014-2413","CVE-2014-2414","CVE-2014-2421","CVE-2014-2423","CVE-2014-2427"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2014-0189.html"},{"type":"WEB","url":"http://blog.fuseyism.com/index.php/2014/04/16/security-icedtea-2-4-7-for-openjdk-7-released/"},{"type":"WEB","url":"http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2014-0406.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=13226"}],"affected":[{"package":{"name":"java-1.7.0-openjdk","ecosystem":"Mageia:3","purl":"pkg:rpm/mageia/java-1.7.0-openjdk?arch=source&distro=mageia-3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.60-2.4.7.1.mga3"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0189.json"}},{"package":{"name":"lcms2","ecosystem":"Mageia:3","purl":"pkg:rpm/mageia/lcms2?arch=source&distro=mageia-3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5-1.1.mga3"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0189.json"}},{"package":{"name":"java-1.7.0-openjdk","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/java-1.7.0-openjdk?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.60-2.4.7.1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0189.json"}},{"package":{"name":"lcms2","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/lcms2?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5-2.1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0189.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}