CVE-2014-1876

Published: Feb 10, 2014Modified: Apr 29, 2026

4.4

Vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 3.4 / Impact: 6.4

Source: NVD

Description

The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.

Affected (3)

Products: Oracle: Openjdk

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Openjdk	Version 1.6.0
Oracle Openjdk	Version 1.7.0
Oracle Openjdk	Version 1.8.0

Related CWEs

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (44)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=140852886808946&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=140852974709252&w=2

Source: cve@mitre.org

http://osvdb.org/102808

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2014-0675.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2014-0685.html

Source: cve@mitre.org

http://seclists.org/oss-sec/2014/q1/242

Source: cve@mitre.org

http://seclists.org/oss-sec/2014/q1/285

Source: cve@mitre.org

http://secunia.com/advisories/58415

Source: cve@mitre.org

http://secunia.com/advisories/59058

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-201406-32.xml

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21672080

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21676746

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21679713

Source: cve@mitre.org

http://www.debian.org/security/2014/dsa-2912

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/65568

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2187-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2191-1

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2014:0413

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2014:0414

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=1060907

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=140852886808946&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=140852974709252&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/102808

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0675.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0685.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/oss-sec/2014/q1/242

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/oss-sec/2014/q1/285

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/58415

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/59058

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-201406-32.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=swg21672080

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=swg21676746

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=swg21679713

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2014/dsa-2912

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/65568

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2187-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2191-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2014:0413

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2014:0414

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1060907

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.