Description
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to "insufficient security checks in IIOP streams," which allows attackers to escape the sandbox.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.1.0-1jpp.2.el7_0 | RHSA-2014:0705 |
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.16.5-1jpp.1.el6_5 | RHSA-2014:0136 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.15.1-1jpp.1.el6_5 | RHSA-2014:0135 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-3.1.13.1.el6_5 | RHSA-2014:0097 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.6.1-1jpp.1.el6_5 | RHSA-2014:0134 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.51-2.4.4.1.el6_5 | RHSA-2014:0026 |
| RHEL 6 | java-1.7.0-oracle +5 | 1:1.7.0.51-1jpp.1.el6_5 | RHSA-2014:0030 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.16.5-1jpp.1.el5_10 | RHSA-2014:0136 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.15.1-1jpp.1.el5_10 | RHSA-2014:0135 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-3.1.13.1.el5_10 | RHSA-2014:0097 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.6.1-1jpp.1.el5_10 | RHSA-2014:0134 |
| RHEL 5 | java-1.7.0-openjdk +4 | 1:1.7.0.51-2.4.4.1.el5_10 | RHSA-2014:0027 |
| RHEL 5 | java-1.7.0-oracle +5 | 1:1.7.0.51-1jpp.1.el5_10 | RHSA-2014:0030 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.1.el6_5 | RHSA-2014:0414 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.3.el5_10 | RHSA-2014:0414 |
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.16.0-1jpp.1.el5 | RHSA-2014:0982 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Advisories 11
- RHSA-2014:0982 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0705 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0414 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0136 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0135 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0097 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0134 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0030 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0026 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0027 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 56432 third-party-advisory
- RHSA-2014:0414 vendor-advisory
- RHSA-2014:0136 vendor-advisory
- openSUSE-SU-2014:0174 vendor-advisory
- SSRT101455 vendor-advisory
- RHSA-2014:0135 vendor-advisory
- 56535 third-party-advisory
- USN-2089-1 vendor-advisory
- RHSA-2014:0030 vendor-advisory
- RHSA-2014:0097 vendor-advisory
- 56485 third-party-advisory
- SSRT101454 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777
- https://bugzilla.redhat.com/show_bug.cgi?id=1051519
- 64935 vdb-entry
- RHSA-2014:0027 vendor-advisory
- 56486 third-party-advisory
- SUSE-SU-2014:0451 vendor-advisory
- 1029608 vdb-entry
- http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/0a879f00b698
- USN-2124-1 vendor-advisory
- SUSE-SU-2014:0266 vendor-advisory
- RHSA-2014:0026 vendor-advisory
- 64758 vdb-entry
- SUSE-SU-2014:0246 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- RHSA-2014:0134 vendor-advisory
- 101996 vdb-entry
- openSUSE-SU-2014:0180 vendor-advisory
- openSUSE-SU-2014:0177 vendor-advisory