CVE-2014-1876

Currently unrated

Key Information:

Vendor
Oracle
Status
Openjdk
Vendor
CVE Published:
10 February 2014

Summary

The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.

References

http://www.ubuntu.com/usn/USN-2187-1
vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2014-0675.html
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2014:0414
vendor-advisoryx_refsource_REDHAT

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.