Description
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an improper check for "code permissions when creating document builder factories."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.1.0-1jpp.2.el7_0 | RHSA-2014:0705 |
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.16.5-1jpp.1.el6_5 | RHSA-2014:0136 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.15.1-1jpp.1.el6_5 | RHSA-2014:0135 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-3.1.13.1.el6_5 | RHSA-2014:0097 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.6.1-1jpp.1.el6_5 | RHSA-2014:0134 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.51-2.4.4.1.el6_5 | RHSA-2014:0026 |
| RHEL 6 | java-1.7.0-oracle +5 | 1:1.7.0.51-1jpp.1.el6_5 | RHSA-2014:0030 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.16.5-1jpp.1.el5_10 | RHSA-2014:0136 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.15.1-1jpp.1.el5_10 | RHSA-2014:0135 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-3.1.13.1.el5_10 | RHSA-2014:0097 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.6.1-1jpp.1.el5_10 | RHSA-2014:0134 |
| RHEL 5 | java-1.7.0-openjdk +4 | 1:1.7.0.51-2.4.4.1.el5_10 | RHSA-2014:0027 |
| RHEL 5 | java-1.7.0-oracle +5 | 1:1.7.0.51-1jpp.1.el5_10 | RHSA-2014:0030 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.1.el6_5 | RHSA-2014:0414 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.3.el5_10 | RHSA-2014:0414 |
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.16.0-1jpp.1.el5 | RHSA-2014:0982 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Advisories 11
- RHSA-2014:0982 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0705 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0414 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0136 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0135 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0097 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0134 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0030 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0026 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0027 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 56432 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1051923
- RHSA-2014:0414 vendor-advisory
- RHSA-2014:0136 vendor-advisory
- openSUSE-SU-2014:0174 vendor-advisory
- http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/42be8e6266ab
- SSRT101455 vendor-advisory
- RHSA-2014:0135 vendor-advisory
- 56535 third-party-advisory
- USN-2089-1 vendor-advisory
- 64907 vdb-entry
- RHSA-2014:0030 vendor-advisory
- RHSA-2014:0097 vendor-advisory
- 56485 third-party-advisory
- SSRT101454 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777
- http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/783ceae9b736
- 102018 vdb-entry
- RHSA-2014:0027 vendor-advisory
- 56486 third-party-advisory
- SUSE-SU-2014:0451 vendor-advisory
- 1029608 vdb-entry
- USN-2124-1 vendor-advisory
- SUSE-SU-2014:0266 vendor-advisory
- oracle-cpujan2014-cve20140376(90350) vdb-entry
- RHSA-2014:0026 vendor-advisory
- 64758 vdb-entry
- SUSE-SU-2014:0246 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- RHSA-2014:0134 vendor-advisory
- openSUSE-SU-2014:0180 vendor-advisory
- openSUSE-SU-2014:0177 vendor-advisory