Description
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.1.0-1jpp.2.el7_0 | RHSA-2014:0705 |
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.16.5-1jpp.1.el6_5 | RHSA-2014:0136 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.15.1-1jpp.1.el6_5 | RHSA-2014:0135 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-3.1.13.1.el6_5 | RHSA-2014:0097 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.6.1-1jpp.1.el6_5 | RHSA-2014:0134 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.51-2.4.4.1.el6_5 | RHSA-2014:0026 |
| RHEL 6 | java-1.7.0-oracle +5 | 1:1.7.0.51-1jpp.1.el6_5 | RHSA-2014:0030 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.16.5-1jpp.1.el5_10 | RHSA-2014:0136 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.15.1-1jpp.1.el5_10 | RHSA-2014:0135 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-3.1.13.1.el5_10 | RHSA-2014:0097 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.6.1-1jpp.1.el5_10 | RHSA-2014:0134 |
| RHEL 5 | java-1.7.0-openjdk +4 | 1:1.7.0.51-2.4.4.1.el5_10 | RHSA-2014:0027 |
| RHEL 5 | java-1.7.0-oracle +5 | 1:1.7.0.51-1jpp.1.el5_10 | RHSA-2014:0030 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.1.el6_5 | RHSA-2014:0414 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.3.el5_10 | RHSA-2014:0414 |
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.16.0-1jpp.1.el5 | RHSA-2014:0982 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Advisories 11
- RHSA-2014:0982 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0705 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0414 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0136 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0135 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0097 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0134 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0030 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0026 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0027 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 56432 third-party-advisory
- oracle-cpujan2014-cve20140423(90340) vdb-entry
- RHSA-2014:0414 vendor-advisory
- RHSA-2014:0136 vendor-advisory
- openSUSE-SU-2014:0174 vendor-advisory
- SSRT101455 vendor-advisory
- RHSA-2014:0135 vendor-advisory
- 64914 vdb-entry
- 56535 third-party-advisory
- USN-2089-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1053066
- RHSA-2014:0030 vendor-advisory
- RHSA-2014:0097 vendor-advisory
- 56485 third-party-advisory
- SSRT101454 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777
- 59283 third-party-advisory
- RHSA-2014:0027 vendor-advisory
- 56486 third-party-advisory
- SUSE-SU-2014:0451 vendor-advisory
- 1029608 vdb-entry
- USN-2124-1 vendor-advisory
- 56487 third-party-advisory
- SUSE-SU-2014:0266 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21677388
- RHSA-2014:0026 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21679287
- 64758 vdb-entry
- SUSE-SU-2014:0246 vendor-advisory
- 60568 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- RHSA-2014:0134 vendor-advisory
- http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/995b32f013f5
- openSUSE-SU-2014:0180 vendor-advisory
- openSUSE-SU-2014:0177 vendor-advisory