ID CVE-2014-6558
Summary Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:jrockit:r27.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:jrockit:r27.8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jrockit:r28.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:jrockit:r28.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.5.0:update_71:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.5.0:update_71:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.6.0:update_81:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.6.0:update_81:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update_60:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update_60:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update_67:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update_67:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.8.0:update_20:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.8.0:update_20:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.5.0:update_71:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.5.0:update_71:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.6.0:update_81:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.6.0:update_81:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update_60:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update_60:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update_67:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update_67:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.8.0:update_20:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.8.0:update_20:*:*:*:*:*:*
CVSS
Base: 2.6 (as of 03-01-2017 - 02:59)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:H/Au:N/C:N/I:P/A:N
redhat via4
advisories
  • bugzilla
    id 1151517
    title CVE-2014-6511 ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540)
    oval
    OR
    • AND
      • OR
        • comment Red Hat Enterprise Linux 7 Client is installed
          oval oval:com.redhat.rhba:tst:20150364001
        • comment Red Hat Enterprise Linux 7 Server is installed
          oval oval:com.redhat.rhba:tst:20150364002
        • comment Red Hat Enterprise Linux 7 Workstation is installed
          oval oval:com.redhat.rhba:tst:20150364003
        • comment Red Hat Enterprise Linux 7 ComputeNode is installed
          oval oval:com.redhat.rhba:tst:20150364004
      • OR
        • AND
          • comment java-1.7.0-openjdk is earlier than 1:1.7.0.71-2.5.3.1.el7_0
            oval oval:com.redhat.rhsa:tst:20141620005
          • comment java-1.7.0-openjdk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009006
        • AND
          • comment java-1.7.0-openjdk-accessibility is earlier than 1:1.7.0.71-2.5.3.1.el7_0
            oval oval:com.redhat.rhsa:tst:20141620011
          • comment java-1.7.0-openjdk-accessibility is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20140675018
        • AND
          • comment java-1.7.0-openjdk-demo is earlier than 1:1.7.0.71-2.5.3.1.el7_0
            oval oval:com.redhat.rhsa:tst:20141620007
          • comment java-1.7.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009010
        • AND
          • comment java-1.7.0-openjdk-devel is earlier than 1:1.7.0.71-2.5.3.1.el7_0
            oval oval:com.redhat.rhsa:tst:20141620009
          • comment java-1.7.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009008
        • AND
          • comment java-1.7.0-openjdk-headless is earlier than 1:1.7.0.71-2.5.3.1.el7_0
            oval oval:com.redhat.rhsa:tst:20141620013
          • comment java-1.7.0-openjdk-headless is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20140675012
        • AND
          • comment java-1.7.0-openjdk-javadoc is earlier than 1:1.7.0.71-2.5.3.1.el7_0
            oval oval:com.redhat.rhsa:tst:20141620015
          • comment java-1.7.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009012
        • AND
          • comment java-1.7.0-openjdk-src is earlier than 1:1.7.0.71-2.5.3.1.el7_0
            oval oval:com.redhat.rhsa:tst:20141620017
          • comment java-1.7.0-openjdk-src is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009014
    • AND
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhba:tst:20111656001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhba:tst:20111656002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhba:tst:20111656003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhba:tst:20111656004
      • OR
        • AND
          • comment java-1.7.0-openjdk is earlier than 1:1.7.0.71-2.5.3.1.el6
            oval oval:com.redhat.rhsa:tst:20141620023
          • comment java-1.7.0-openjdk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009006
        • AND
          • comment java-1.7.0-openjdk-demo is earlier than 1:1.7.0.71-2.5.3.1.el6
            oval oval:com.redhat.rhsa:tst:20141620027
          • comment java-1.7.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009010
        • AND
          • comment java-1.7.0-openjdk-devel is earlier than 1:1.7.0.71-2.5.3.1.el6
            oval oval:com.redhat.rhsa:tst:20141620026
          • comment java-1.7.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009008
        • AND
          • comment java-1.7.0-openjdk-javadoc is earlier than 1:1.7.0.71-2.5.3.1.el6
            oval oval:com.redhat.rhsa:tst:20141620024
          • comment java-1.7.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009012
        • AND
          • comment java-1.7.0-openjdk-src is earlier than 1:1.7.0.71-2.5.3.1.el6
            oval oval:com.redhat.rhsa:tst:20141620025
          • comment java-1.7.0-openjdk-src is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009014
    rhsa
    id RHSA-2014:1620
    released 2014-10-15
    severity Important
    title RHSA-2014:1620: java-1.7.0-openjdk security and bug fix update (Important)
  • bugzilla
    id 1151517
    title CVE-2014-6511 ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540)
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331001
    • OR
      • AND
        • comment java-1.7.0-openjdk is earlier than 1:1.7.0.71-2.5.3.1.el5_11
          oval oval:com.redhat.rhsa:tst:20141633002
        • comment java-1.7.0-openjdk is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130165017
      • AND
        • comment java-1.7.0-openjdk-demo is earlier than 1:1.7.0.71-2.5.3.1.el5_11
          oval oval:com.redhat.rhsa:tst:20141633006
        • comment java-1.7.0-openjdk-demo is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130165025
      • AND
        • comment java-1.7.0-openjdk-devel is earlier than 1:1.7.0.71-2.5.3.1.el5_11
          oval oval:com.redhat.rhsa:tst:20141633008
        • comment java-1.7.0-openjdk-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130165023
      • AND
        • comment java-1.7.0-openjdk-javadoc is earlier than 1:1.7.0.71-2.5.3.1.el5_11
          oval oval:com.redhat.rhsa:tst:20141633010
        • comment java-1.7.0-openjdk-javadoc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130165021
      • AND
        • comment java-1.7.0-openjdk-src is earlier than 1:1.7.0.71-2.5.3.1.el5_11
          oval oval:com.redhat.rhsa:tst:20141633004
        • comment java-1.7.0-openjdk-src is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130165019
    rhsa
    id RHSA-2014:1633
    released 2014-10-14
    severity Important
    title RHSA-2014:1633: java-1.7.0-openjdk security and bug fix update (Important)
  • bugzilla
    id 1151517
    title CVE-2014-6511 ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540)
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331001
      • OR
        • AND
          • comment java-1.6.0-openjdk is earlier than 1:1.6.0.33-1.13.5.0.el5_11
            oval oval:com.redhat.rhsa:tst:20141634002
          • comment java-1.6.0-openjdk is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377003
        • AND
          • comment java-1.6.0-openjdk-demo is earlier than 1:1.6.0.33-1.13.5.0.el5_11
            oval oval:com.redhat.rhsa:tst:20141634006
          • comment java-1.6.0-openjdk-demo is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377011
        • AND
          • comment java-1.6.0-openjdk-devel is earlier than 1:1.6.0.33-1.13.5.0.el5_11
            oval oval:com.redhat.rhsa:tst:20141634010
          • comment java-1.6.0-openjdk-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377005
        • AND
          • comment java-1.6.0-openjdk-javadoc is earlier than 1:1.6.0.33-1.13.5.0.el5_11
            oval oval:com.redhat.rhsa:tst:20141634008
          • comment java-1.6.0-openjdk-javadoc is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377007
        • AND
          • comment java-1.6.0-openjdk-src is earlier than 1:1.6.0.33-1.13.5.0.el5_11
            oval oval:com.redhat.rhsa:tst:20141634004
          • comment java-1.6.0-openjdk-src is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377009
    • AND
      • OR
        • comment Red Hat Enterprise Linux 7 Client is installed
          oval oval:com.redhat.rhba:tst:20150364001
        • comment Red Hat Enterprise Linux 7 Server is installed
          oval oval:com.redhat.rhba:tst:20150364002
        • comment Red Hat Enterprise Linux 7 Workstation is installed
          oval oval:com.redhat.rhba:tst:20150364003
        • comment Red Hat Enterprise Linux 7 ComputeNode is installed
          oval oval:com.redhat.rhba:tst:20150364004
      • OR
        • AND
          • comment java-1.6.0-openjdk is earlier than 1:1.6.0.33-1.13.5.0.el7_0
            oval oval:com.redhat.rhsa:tst:20141634016
          • comment java-1.6.0-openjdk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865006
        • AND
          • comment java-1.6.0-openjdk-demo is earlier than 1:1.6.0.33-1.13.5.0.el7_0
            oval oval:com.redhat.rhsa:tst:20141634020
          • comment java-1.6.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865010
        • AND
          • comment java-1.6.0-openjdk-devel is earlier than 1:1.6.0.33-1.13.5.0.el7_0
            oval oval:com.redhat.rhsa:tst:20141634024
          • comment java-1.6.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865008
        • AND
          • comment java-1.6.0-openjdk-javadoc is earlier than 1:1.6.0.33-1.13.5.0.el7_0
            oval oval:com.redhat.rhsa:tst:20141634018
          • comment java-1.6.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865014
        • AND
          • comment java-1.6.0-openjdk-src is earlier than 1:1.6.0.33-1.13.5.0.el7_0
            oval oval:com.redhat.rhsa:tst:20141634022
          • comment java-1.6.0-openjdk-src is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865012
    • AND
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhba:tst:20111656001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhba:tst:20111656002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhba:tst:20111656003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhba:tst:20111656004
      • OR
        • AND
          • comment java-1.6.0-openjdk is earlier than 1:1.6.0.33-1.13.5.0.el6_6
            oval oval:com.redhat.rhsa:tst:20141634030
          • comment java-1.6.0-openjdk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865006
        • AND
          • comment java-1.6.0-openjdk-demo is earlier than 1:1.6.0.33-1.13.5.0.el6_6
            oval oval:com.redhat.rhsa:tst:20141634034
          • comment java-1.6.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865010
        • AND
          • comment java-1.6.0-openjdk-devel is earlier than 1:1.6.0.33-1.13.5.0.el6_6
            oval oval:com.redhat.rhsa:tst:20141634032
          • comment java-1.6.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865008
        • AND
          • comment java-1.6.0-openjdk-javadoc is earlier than 1:1.6.0.33-1.13.5.0.el6_6
            oval oval:com.redhat.rhsa:tst:20141634033
          • comment java-1.6.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865014
        • AND
          • comment java-1.6.0-openjdk-src is earlier than 1:1.6.0.33-1.13.5.0.el6_6
            oval oval:com.redhat.rhsa:tst:20141634031
          • comment java-1.6.0-openjdk-src is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865012
    rhsa
    id RHSA-2014:1634
    released 2014-10-14
    severity Important
    title RHSA-2014:1634: java-1.6.0-openjdk security and bug fix update (Important)
  • rhsa
    id RHSA-2014:1636
  • rhsa
    id RHSA-2014:1657
  • rhsa
    id RHSA-2014:1658
  • rhsa
    id RHSA-2014:1876
  • rhsa
    id RHSA-2014:1877
  • rhsa
    id RHSA-2014:1880
  • rhsa
    id RHSA-2014:1881
  • rhsa
    id RHSA-2014:1882
  • rhsa
    id RHSA-2015:0264
rpms
  • java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el7_0
  • java-1.7.0-openjdk-accessibility-1:1.7.0.71-2.5.3.1.el7_0
  • java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el7_0
  • java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el7_0
  • java-1.7.0-openjdk-headless-1:1.7.0.71-2.5.3.1.el7_0
  • java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el7_0
  • java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el7_0
  • java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el6
  • java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el6
  • java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el6
  • java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el6
  • java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el6
  • java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11
  • java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11
  • java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11
  • java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11
  • java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11
  • java-1.6.0-openjdk-1:1.6.0.33-1.13.5.0.el5_11
  • java-1.6.0-openjdk-demo-1:1.6.0.33-1.13.5.0.el5_11
  • java-1.6.0-openjdk-devel-1:1.6.0.33-1.13.5.0.el5_11
  • java-1.6.0-openjdk-javadoc-1:1.6.0.33-1.13.5.0.el5_11
  • java-1.6.0-openjdk-src-1:1.6.0.33-1.13.5.0.el5_11
  • java-1.6.0-openjdk-1:1.6.0.33-1.13.5.0.el7_0
  • java-1.6.0-openjdk-demo-1:1.6.0.33-1.13.5.0.el7_0
  • java-1.6.0-openjdk-devel-1:1.6.0.33-1.13.5.0.el7_0
  • java-1.6.0-openjdk-javadoc-1:1.6.0.33-1.13.5.0.el7_0
  • java-1.6.0-openjdk-src-1:1.6.0.33-1.13.5.0.el7_0
  • java-1.6.0-openjdk-1:1.6.0.33-1.13.5.0.el6_6
  • java-1.6.0-openjdk-demo-1:1.6.0.33-1.13.5.0.el6_6
  • java-1.6.0-openjdk-devel-1:1.6.0.33-1.13.5.0.el6_6
  • java-1.6.0-openjdk-javadoc-1:1.6.0.33-1.13.5.0.el6_6
  • java-1.6.0-openjdk-src-1:1.6.0.33-1.13.5.0.el6_6
  • java-1.8.0-openjdk-0:1.8.0.25-1.b17.el6
  • java-1.8.0-openjdk-demo-0:1.8.0.25-1.b17.el6
  • java-1.8.0-openjdk-devel-0:1.8.0.25-1.b17.el6
  • java-1.8.0-openjdk-headless-0:1.8.0.25-1.b17.el6
  • java-1.8.0-openjdk-javadoc-0:1.8.0.25-1.b17.el6
  • java-1.8.0-openjdk-src-0:1.8.0.25-1.b17.el6
refmap via4
bid 70544
confirm
debian
  • DSA-3077
  • DSA-3080
gentoo GLSA-201502-12
hp
  • HPSBUX03218
  • SSRT101770
secunia
  • 60414
  • 60416
  • 60417
  • 61018
  • 61020
  • 61143
  • 61163
  • 61164
  • 61346
  • 61609
  • 61629
  • 61631
  • 61928
suse
  • SUSE-SU-2014:1422
  • SUSE-SU-2014:1526
  • SUSE-SU-2014:1549
  • SUSE-SU-2015:0344
  • SUSE-SU-2015:0345
  • SUSE-SU-2015:0376
  • SUSE-SU-2015:0392
ubuntu
  • USN-2386-1
  • USN-2388-1
  • USN-2388-2
Last major update 03-01-2017 - 02:59
Published 15-10-2014 - 22:55
Back to Top