CVE-2014-0423

Description

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.

5.5
CVSS
Severity: Medium
CVSS 2.0 •
EPSS 0.22%
Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory ubuntu.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory oracle.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://secunia.com/advisories/56432 third party advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90340 vdb entry
https://access.redhat.com/errata/RHSA-2014:0414 vendor advisory
http://rhn.redhat.com/errata/RHSA-2014-0136.html vendor advisory
http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html vendor advisory
http://marc.info/?l=bugtraq&m=139402749111889&w=2 vendor advisory
http://rhn.redhat.com/errata/RHSA-2014-0135.html vendor advisory
http://www.securityfocus.com/bid/64914 vdb entry
http://secunia.com/advisories/56535 third party advisory
http://www.ubuntu.com/usn/USN-2089-1 vendor advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1053066
http://rhn.redhat.com/errata/RHSA-2014-0030.html vendor advisory
http://rhn.redhat.com/errata/RHSA-2014-0097.html vendor advisory
http://secunia.com/advisories/56485 third party advisory
http://marc.info/?l=bugtraq&m=139402697611681&w=2 vendor advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777
http://secunia.com/advisories/59283 third party advisory
http://rhn.redhat.com/errata/RHSA-2014-0027.html vendor advisory
http://secunia.com/advisories/56486 third party advisory
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html vendor advisory
http://www.securitytracker.com/id/1029608 vdb entry
http://www.ubuntu.com/usn/USN-2124-1 vendor advisory
http://secunia.com/advisories/56487 third party advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21677388
http://rhn.redhat.com/errata/RHSA-2014-0026.html vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21679287
http://www.securityfocus.com/bid/64758 vdb entry
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html vendor advisory
http://secunia.com/advisories/60568 third party advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html vendor advisory
http://rhn.redhat.com/errata/RHSA-2014-0134.html vendor advisory
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/995b32f013f5
http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html vendor advisory
http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html vendor advisory

Frequently Asked Questions

What is the severity of CVE-2014-0423?
CVE-2014-0423 has been scored as a medium severity vulnerability.
How to fix CVE-2014-0423?
To fix CVE-2014-0423, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2014-0423 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2014-0423 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.