ID CVE-2014-3086
Summary Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain privileges by leveraging the ability to execute code in the context of a security manager.
References
Vulnerable Configurations
  • cpe:2.3:a:ibm:lotus_notes:8.5.3.0
    cpe:2.3:a:ibm:lotus_notes:8.5.3.0
  • IBM Lotus Notes 9.0.1.0
    cpe:2.3:a:ibm:lotus_notes:9.0.1.0
  • IBM Lotus Domino 8.5.3.0
    cpe:2.3:a:ibm:lotus_domino:8.5.3.0
  • IBM Lotus Domino 9.0.1.0
    cpe:2.3:a:ibm:lotus_domino:9.0.1.0
  • IBM Websphere Real Time 3.0
    cpe:2.3:a:ibm:websphere_real_time:3.0
CVSS
Base: 7.5 (as of 20-11-2015 - 10:46)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1036.NASL
    description Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-4209, CVE-2014-4218, CVE-2014-4219, CVE-2014-4244, CVE-2014-4252, CVE-2014-4262, CVE-2014-4263) The CVE-2014-4262 issue was discovered by Florian Weimer of Red Hat Product Security. All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM J2SE 5.0 SR16-FP7 release. All running instances of IBM Java must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 77083
    published 2014-08-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77083
    title RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2014:1036)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1042.NASL
    description Updated java-1.7.1-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 7 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-4208, CVE-2014-4209, CVE-2014-4218, CVE-2014-4219, CVE-2014-4220, CVE-2014-4221, CVE-2014-4227, CVE-2014-4244, CVE-2014-4252, CVE-2014-4262, CVE-2014-4263, CVE-2014-4265, CVE-2014-4266) The CVE-2014-4262 issue was discovered by Florian Weimer of Red Hat Product Security. All users of java-1.7.1-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7R1 SR1-FP1 release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 77143
    published 2014-08-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77143
    title RHEL 7 : java-1.7.1-ibm (RHSA-2014:1042)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1041.NASL
    description Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-4208, CVE-2014-4209, CVE-2014-4218, CVE-2014-4219, CVE-2014-4220, CVE-2014-4221, CVE-2014-4227, CVE-2014-4244, CVE-2014-4252, CVE-2014-4262, CVE-2014-4263, CVE-2014-4265, CVE-2014-4266) The CVE-2014-4262 issue was discovered by Florian Weimer of Red Hat Product Security. All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR7-FP1 release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 77142
    published 2014-08-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77142
    title RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2014:1041)
  • NASL family AIX Local Security Checks
    NASL id AIX_JAVA_JUL2014_ADVISORY.NASL
    description The version of Java SDK installed on the remote host is affected by the following vulnerabilities : - A privilege escalation vulnerability in IBM Java Virtual Machine allows remote attackers to execute code to increase access in the context of a security manager. (CVE-2014-3086) - Data integrity vulnerabilities exist in Oracle Java within the the Deployment subcomponent. (CVE-2014-4208, CVE-2014-4220, CVE-2014-4265) - An information disclosure vulnerability in Oracle Java's JMX subcomponent allows a remote attacker to view or edit the SubjectDelegator class. (CVE-2014-4209) - A vulnerability in Oracle Java allows a remote attacker to bypass security features via flaws in 'Proxy.java' in the Libraries subcomponent. (CVE-2014-4218) - A vulnerability in Oracle Java allows remote code execution via a flaw in the Hotspot subcomponent, returning incomplete objects. (CVE-2014-4219) - An information disclosure vulnerability in Oracle Java's Libraries subcomponent allows a remote attacker to view sensitive information. (CVE-2014-4221) - Vulnerabilities in Oracle Java allow remote code execution via flaws in the Deployment subcomponent. (CVE-2014-4227) - There are information disclosure vulnerabilities in the Security subcomponent of Oracle Java that can allow remote attackers to gain sensitive information, including information about used keys. (CVE-2014-4244, CVE-2014-4252, CVE-2014-4263) - A vulnerability in Oracle Java allows remote code execution via a memory corruption flaw in the Libraries subcomponent. (CVE-2014-4262) - A data integrity vulnerability exists in Oracle Java within the Serviceability subcomponent due to incorrect function return values. (CVE-2014-4266) - An information disclosure vulnerability in Oracle Java's Swing subcomponent allows a remote attacker to view restricted file contents. (CVE-2014-4268)
    last seen 2019-02-21
    modified 2018-07-17
    plugin id 77333
    published 2014-08-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77333
    title AIX Java Advisory : java_jul2014_advisory.asc
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1033.NASL
    description Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-4209, CVE-2014-4218, CVE-2014-4219, CVE-2014-4227, CVE-2014-4244, CVE-2014-4252, CVE-2014-4262, CVE-2014-4263, CVE-2014-4265) The CVE-2014-4262 issue was discovered by Florian Weimer of Red Hat Product Security. All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 6 SR16-FP1 release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 77081
    published 2014-08-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77081
    title RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2014:1033)
redhat via4
rpms
  • java-1.6.0-ibm-1:1.6.0.16.1-1jpp.1.el5_10
  • java-1.6.0-ibm-accessibility-1:1.6.0.16.1-1jpp.1.el5_10
  • java-1.6.0-ibm-demo-1:1.6.0.16.1-1jpp.1.el5_10
  • java-1.6.0-ibm-devel-1:1.6.0.16.1-1jpp.1.el5_10
  • java-1.6.0-ibm-javacomm-1:1.6.0.16.1-1jpp.1.el5_10
  • java-1.6.0-ibm-jdbc-1:1.6.0.16.1-1jpp.1.el5_10
  • java-1.6.0-ibm-plugin-1:1.6.0.16.1-1jpp.1.el5_10
  • java-1.6.0-ibm-src-1:1.6.0.16.1-1jpp.1.el5_10
  • java-1.6.0-ibm-1:1.6.0.16.1-1jpp.1.el6_5
  • java-1.6.0-ibm-demo-1:1.6.0.16.1-1jpp.1.el6_5
  • java-1.6.0-ibm-devel-1:1.6.0.16.1-1jpp.1.el6_5
  • java-1.6.0-ibm-javacomm-1:1.6.0.16.1-1jpp.1.el6_5
  • java-1.6.0-ibm-jdbc-1:1.6.0.16.1-1jpp.1.el6_5
  • java-1.6.0-ibm-plugin-1:1.6.0.16.1-1jpp.1.el6_5
  • java-1.6.0-ibm-src-1:1.6.0.16.1-1jpp.1.el6_5
  • java-1.5.0-ibm-1:1.5.0.16.7-1jpp.1.el5_10
  • java-1.5.0-ibm-accessibility-1:1.5.0.16.7-1jpp.1.el5_10
  • java-1.5.0-ibm-demo-1:1.5.0.16.7-1jpp.1.el5_10
  • java-1.5.0-ibm-devel-1:1.5.0.16.7-1jpp.1.el5_10
  • java-1.5.0-ibm-javacomm-1:1.5.0.16.7-1jpp.1.el5_10
  • java-1.5.0-ibm-jdbc-1:1.5.0.16.7-1jpp.1.el5_10
  • java-1.5.0-ibm-plugin-1:1.5.0.16.7-1jpp.1.el5_10
  • java-1.5.0-ibm-src-1:1.5.0.16.7-1jpp.1.el5_10
  • java-1.5.0-ibm-1:1.5.0.16.7-1jpp.1.el6_5
  • java-1.5.0-ibm-demo-1:1.5.0.16.7-1jpp.1.el6_5
  • java-1.5.0-ibm-devel-1:1.5.0.16.7-1jpp.1.el6_5
  • java-1.5.0-ibm-javacomm-1:1.5.0.16.7-1jpp.1.el6_5
  • java-1.5.0-ibm-jdbc-1:1.5.0.16.7-1jpp.1.el6_5
  • java-1.5.0-ibm-plugin-1:1.5.0.16.7-1jpp.1.el6_5
  • java-1.5.0-ibm-src-1:1.5.0.16.7-1jpp.1.el6_5
  • java-1.7.0-ibm-1:1.7.0.7.1-1jpp.1.el5_10
  • java-1.7.0-ibm-demo-1:1.7.0.7.1-1jpp.1.el5_10
  • java-1.7.0-ibm-devel-1:1.7.0.7.1-1jpp.1.el5_10
  • java-1.7.0-ibm-jdbc-1:1.7.0.7.1-1jpp.1.el5_10
  • java-1.7.0-ibm-plugin-1:1.7.0.7.1-1jpp.1.el5_10
  • java-1.7.0-ibm-src-1:1.7.0.7.1-1jpp.1.el5_10
  • java-1.7.0-ibm-1:1.7.0.7.1-1jpp.1.el6_5
  • java-1.7.0-ibm-demo-1:1.7.0.7.1-1jpp.1.el6_5
  • java-1.7.0-ibm-devel-1:1.7.0.7.1-1jpp.1.el6_5
  • java-1.7.0-ibm-jdbc-1:1.7.0.7.1-1jpp.1.el6_5
  • java-1.7.0-ibm-plugin-1:1.7.0.7.1-1jpp.1.el6_5
  • java-1.7.0-ibm-src-1:1.7.0.7.1-1jpp.1.el6_5
refmap via4
aixapar IV62634
bid 69183
confirm
secunia
  • 59680
  • 60081
  • 60317
  • 60622
  • 61577
  • 61640
xf ibm-java-cve20143086-code-exec(94097)
Last major update 06-01-2017 - 21:59
Published 11-08-2014 - 20:55
Last modified 28-08-2017 - 21:34
Back to Top