Description
Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and Jrockit R27.8.3 and R28.3.3 allows remote attackers to affect confidentiality via vectors related to JAXP.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | openjdk-6 | 6b33-1.13.5-2~deb7u1 | DSA-3077-1 |
| Debian 7 | openjdk-7 | 7u71-2.5.3-2~deb7u1 | DSA-3080-1 |
| Debian 6.0 | openjdk-6 | 6b33-1.13.5-2~deb6u1 | DLA-96-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openjdk-6 | 6b33-1.13.5-1ubuntu0.14.04 | — |
| Ubuntu 14.04 LTS | openjdk-7 | 7u71-2.5.3-0ubuntu0.14.04.1 | USN-2388-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.6.0-openjdk +4 | 1:1.6.0.33-1.13.5.0.el7_0 | RHSA-2014:1634 |
| RHEL 7 | java-1.7.0-openjdk +6 | 1:1.7.0.71-2.5.3.1.el7_0 | RHSA-2014:1620 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.33-1.13.5.0.el6_6 | RHSA-2014:1634 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.71-2.5.3.1.el6 | RHSA-2014:1620 |
| RHEL 6 | java-1.8.0-openjdk +5 | 1.8.0.25-1.b17.el6 | RHSA-2014:1636 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.33-1.13.5.0.el5_11 | RHSA-2014:1634 |
| RHEL 5 | java-1.7.0-openjdk +4 | 1:1.7.0.71-2.5.3.1.el5_11 | RHSA-2014:1633 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 7 | java-1.6.0-sun +5 | 1:1.6.0.85-1jpp.2.el7 | RHSA-2014:1658 |
| Red Hat Rhel Extras Oracle Java 7 | java-1.7.0-oracle +5 | 1:1.7.0.72-1jpp.2.el7 | RHSA-2014:1657 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.85-1jpp.2.el6 | RHSA-2014:1658 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.7.0-oracle +5 | 1:1.7.0.72-1jpp.2.el6 | RHSA-2014:1657 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.85-1jpp.3.el5_11 | RHSA-2014:1658 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.7.0-oracle +5 | 1:1.7.0.72-1jpp.4.el5_11 | RHSA-2014:1657 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | java-1.6.0-openjdk +4 | 1:1.6.0.33-1.13.5.0.0.1.el5_11 | ELSA-2014-1634 |
| Oracle Linux 7 | java-1.7.0-openjdk +6 | 1:1.7.0.71-2.5.3.1.0.1.el7_0 | ELSA-2014-1620 |
Advisories 13
- RHSA-2014:1657 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1658 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1636 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1633 Red Hat Security Advisory: java-1.7.0-openjdk security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1634 Red Hat Security Advisory: java-1.6.0-openjdk security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1620 Red Hat Security Advisory: java-1.7.0-openjdk security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DLA-96-1 openjdk-6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3080-1 openjdk-7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3077-1 openjdk-6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2388-1 openjdk-7 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2014-1620 Important: java-1.7.0-openjdk security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 15, 2014
- ELSA-2014-1634 Important: java-1.6.0-openjdk security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 14, 2014
References
- 60414 third-party-advisory
- RHSA-2014:1657 vendor-advisory
- 61609 third-party-advisory
- 61928 third-party-advisory
- 61163 third-party-advisory
- USN-2386-1 vendor-advisory
- http://linux.oracle.com/errata/ELSA-2014-1633.html
- USN-2388-1 vendor-advisory
- HPSBUX03218 vendor-advisory
- 61629 third-party-advisory
- 61018 third-party-advisory
- http://linux.oracle.com/errata/ELSA-2014-1634.html
- 61346 third-party-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10092
- RHSA-2014:1634 vendor-advisory
- USN-2388-2 vendor-advisory
- SUSE-SU-2014:1422 vendor-advisory
- 70552 vdb-entry
- DSA-3080 vendor-advisory
- 60416 third-party-advisory
- RHSA-2014:1633 vendor-advisory
- RHSA-2014:1636 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- RHSA-2014:1658 vendor-advisory
- 61164 third-party-advisory
- DSA-3077 vendor-advisory
- http://linux.oracle.com/errata/ELSA-2014-1636
- GLSA-201502-12 vendor-advisory
- 61020 third-party-advisory
- 61143 third-party-advisory
- 60417 third-party-advisory
- 61631 third-party-advisory
- RHSA-2014:1620 vendor-advisory