Description
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is due to incorrect input validation in LookupProcessor.cpp in the ICU Layout Engine, which allows attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted font file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.1.0-1jpp.2.el7_0 | RHSA-2014:0705 |
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.16.5-1jpp.1.el6_5 | RHSA-2014:0136 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.15.1-1jpp.1.el6_5 | RHSA-2014:0135 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-3.1.13.1.el6_5 | RHSA-2014:0097 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.6.1-1jpp.1.el6_5 | RHSA-2014:0134 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.51-2.4.4.1.el6_5 | RHSA-2014:0026 |
| RHEL 6 | java-1.7.0-oracle +5 | 1:1.7.0.51-1jpp.1.el6_5 | RHSA-2014:0030 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.16.5-1jpp.1.el5_10 | RHSA-2014:0136 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.15.1-1jpp.1.el5_10 | RHSA-2014:0135 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-3.1.13.1.el5_10 | RHSA-2014:0097 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.6.1-1jpp.1.el5_10 | RHSA-2014:0134 |
| RHEL 5 | java-1.7.0-openjdk +4 | 1:1.7.0.51-2.4.4.1.el5_10 | RHSA-2014:0027 |
| RHEL 5 | java-1.7.0-oracle +5 | 1:1.7.0.51-1jpp.1.el5_10 | RHSA-2014:0030 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.1.el6_5 | RHSA-2014:0414 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.3.el5_10 | RHSA-2014:0414 |
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.16.0-1jpp.1.el5 | RHSA-2014:0982 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Advisories 11
- RHSA-2014:0982 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0705 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0414 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0136 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0135 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0097 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0134 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0030 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0026 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0027 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 56432 third-party-advisory
- RHSA-2014:0414 vendor-advisory
- RHSA-2014:0136 vendor-advisory
- openSUSE-SU-2014:0174 vendor-advisory
- SSRT101455 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1052915
- RHSA-2014:0135 vendor-advisory
- 56535 third-party-advisory
- USN-2089-1 vendor-advisory
- 101995 vdb-entry
- RHSA-2014:0030 vendor-advisory
- 64894 vdb-entry
- RHSA-2014:0097 vendor-advisory
- 56485 third-party-advisory
- SSRT101454 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777
- http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/9d29c19f1de1
- RHSA-2014:0027 vendor-advisory
- 56486 third-party-advisory
- SUSE-SU-2014:0451 vendor-advisory
- 1029608 vdb-entry
- USN-2124-1 vendor-advisory
- 56487 third-party-advisory
- SUSE-SU-2014:0266 vendor-advisory
- RHSA-2014:0026 vendor-advisory
- 64758 vdb-entry
- SUSE-SU-2014:0246 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- RHSA-2014:0134 vendor-advisory
- openSUSE-SU-2014:0180 vendor-advisory
- openSUSE-SU-2014:0177 vendor-advisory