Vulnerability Name:

CVE-2014-4265 (CCN-94597)

Assigned:2014-07-15
Published:2014-07-15
Updated:2022-05-13
Summary:Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.0 Medium (REDHAT CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Other
References:Source: MITRE
Type: CNA
CVE-2014-4265

Source: SUSE
Type: UNKNOWN
SUSE-SU-2015:0344

Source: SUSE
Type: UNKNOWN
SUSE-SU-2015:0392

Source: HP
Type: UNKNOWN
HPSBUX03091

Source: HP
Type: UNKNOWN
HPSBUX03092

Source: CCN
Type: RHSA-2014-1033
Critical: java-1.6.0-ibm security update

Source: CCN
Type: RHSA-2014-1041
Critical: java-1.7.0-ibm security update

Source: CCN
Type: RHSA-2014-1042
Critical: java-1.7.1-ibm security update

Source: REDHAT
Type: UNKNOWN
RHSA-2015:0264

Source: FULLDISC
Type: UNKNOWN
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

Source: SECUNIA
Type: UNKNOWN
59404

Source: SECUNIA
Type: UNKNOWN
59680

Source: SECUNIA
Type: UNKNOWN
59924

Source: SECUNIA
Type: UNKNOWN
59986

Source: SECUNIA
Type: UNKNOWN
59987

Source: SECUNIA
Type: UNKNOWN
60081

Source: SECUNIA
Type: UNKNOWN
60245

Source: SECUNIA
Type: UNKNOWN
60317

Source: SECUNIA
Type: UNKNOWN
60622

Source: SECUNIA
Type: UNKNOWN
60817

Source: SECUNIA
Type: UNKNOWN
61577

Source: SECUNIA
Type: UNKNOWN
61640

Source: GENTOO
Type: UNKNOWN
GLSA-201502-12

Source: CONFIRM
Type: UNKNOWN
http://www-01.ibm.com/support/docview.wss?uid=swg21680334

Source: CONFIRM
Type: UNKNOWN
http://www-01.ibm.com/support/docview.wss?uid=swg21686383

Source: CONFIRM
Type: UNKNOWN
http://www-01.ibm.com/support/docview.wss?uid=swg21686824

Source: CCN
Type: IBM Security Bulletin 1691846
Multiple vulnerabilities in IBM Java SDK affect IBM FileNet System Monitor/IBM Enterprise Content Management System Monitor (CVE-2014-3086, CVE-2014-4227, CVE-2014-4262, CVE-2014-4219, CVE-2014-4268, CVE-2014-4218, CVE-2014-4252, CVE-2

Source: CCN
Type: IBM Security Bulletin 1020258
Multiple vulnerabilities in the IBM SDK Java Technology for IBM i

Source: CCN
Type: IBM Security Bulletin 1680333
Multiple vulnerabilities in current releases of the IBM WebSphere Real Time

Source: CCN
Type: IBM Security Bulletin 1680334
Multiple vulnerabilities in current releases of the IBM SDK, Java Technology Edition

Source: CCN
Type: IBM Security Bulletin 1682038
Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime, affect IBM Endpoint Manager for Remote Control

Source: CCN
Type: IBM Security Bulletin 1682102
Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime, affect Tivoli Endpoint Manager for Remote Control

Source: CCN
Type: IBM Security Bulletin 1685312
IBM Tivoli Composite Application Manager for Transactions affected by multiple vulnerabilities in IBM JRE (Multiple CVEs)

Source: CCN
Type: IBM Security Bulletin 1685333
Multiple vulnerabilities in IBM Java SDK affect Asset and Service Management

Source: CCN
Type: IBM Security Bulletin 1685866
Vulnerabilities in IBM Tivoli System Automation for Integrated Operations Management (Several CVE's)

Source: CCN
Type: IBM Security Bulletin 1686194
Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2014-4227, CVE-2014-4262, CVE-2014-4219, CVE-2014-4209, CVE-2014-4220, CVE-2014-4268, CVE-2014-4218, CVE-2014-4252, C

Source: CCN
Type: IBM Security Bulletin 1686383
CICS Transaction Gateway for Multiplatforms

Source: CCN
Type: IBM Security Bulletin 1686824
IBM Notes and Domino - Multiple vulnerabilities in IBM Java (Oracle July 2014 Critical Patch Update)

Source: CCN
Type: IBM Security Bulletin 1687297
Security Bulletin: IBM Tivoli Monitoring clients affected by vulnerabilities in IBM SDK, Java Technology Edition

Source: CCN
Type: IBM Security Bulletin 1688312
Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Business Viewpoint (CVE-2014-3086, CVE-2014-4227, CVE-2014-4262, CVE-2014-4220, CVE-2014-4218, CVE-2014-4252, CVE-2014-4265, CVE-2014-4221, CVE-2014-4263, CVE-2014-4244)

Source: CCN
Type: IBM Security Bulletin 1688343
IBM Smart Analytics System 5600 is affected by multiple vulnerabilities in the IBM SDK Java Technology Edition, Version 6

Source: CCN
Type: Oracle Critical Patch Update Advisory - July 2014
Oracle Critical Patch Update Advisory - July 2014

Source: CONFIRM
Type: Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Source: BUGTRAQ
Type: UNKNOWN
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

Source: BID
Type: UNKNOWN
68632

Source: CCN
Type: BID-68632
Oracle Java SE CVE-2014-4265 Remote Security Vulnerability

Source: SECTRACK
Type: UNKNOWN
1030577

Source: CONFIRM
Type: UNKNOWN
http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Source: REDHAT
Type: UNKNOWN
RHSA-2014:0902

Source: REDHAT
Type: UNKNOWN
RHSA-2014:0908

Source: XF
Type: UNKNOWN
oracle-cpujul2014-cve20144265(94597)

Source: XF
Type: UNKNOWN
oracle-cpujul2014-cve20144265(94597)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-4265

Vulnerable Configuration:Configuration 1:
  • cpe:/a:oracle:jdk:1.8.0:update5:*:*:*:*:*:*
  • OR cpe:/a:oracle:jdk:1.7.0:update60:*:*:*:*:*:*
  • OR cpe:/a:oracle:jdk:1.6.0:update75:*:*:*:*:*:*
  • OR cpe:/a:oracle:jre:1.6.0:update75:*:*:*:*:*:*
  • OR cpe:/a:oracle:jre:1.8.0:update5:*:*:*:*:*:*
  • OR cpe:/a:oracle:jre:1.7.0:update60:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:rhel_extras_oracle_java:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:rhel_extras_oracle_java:6:*:*:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:rhel_extras_oracle_java:7:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:oracle:jdk:1.8.0:update5:*:*:*:*:*:*
  • OR cpe:/a:oracle:jre:1.8.0:update5:*:*:*:*:*:*
  • OR cpe:/a:oracle:jre:1.7.0:update60:*:*:*:*:*:*
  • OR cpe:/a:oracle:jdk:1.7.0:update60:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:sdk:5.0:*:*:*:java:*:*:*
  • OR cpe:/a:ibm:sdk:6.0:*:*:*:java:*:*:*
  • OR cpe:/a:ibm:cics_transaction_gateway:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_supplementary:6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_workstation_supplementary:6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop_supplementary:6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_hpc_node_supplementary:6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:maximo_asset_management:7.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cics_transaction_gateway:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cics_transaction_gateway:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:filenet_system_monitor:4.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:filenet_system_monitor:5.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_composite_application_manager:7.3:*:*:*:transactions:*:*:*
  • OR cpe:/a:ibm:maximo_asset_management:7.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_composite_application_manager:7.4:*:*:*:transactions:*:*:*
  • OR cpe:/a:ibm:cognos_business_viewpoint:10.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_business_viewpoint:10.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:domino:8.5.3.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:domino:8.5.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:domino:9.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_endpoint_manager:*:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:i:6.1:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:i:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:i:7.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_application_dependency_discovery_manager:7.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_application_dependency_discovery_manager:7.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_application_dependency_discovery_manager:7.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cics_transaction_gateway:9.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:sdk:6.1:*:*:*:java:*:*:*
  • OR cpe:/a:ibm:sdk:7.0:*:*:*:java:*:*:*
  • OR cpe:/a:ibm:sdk:7.1:*:*:*:java:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20144265
    V
    		CVE-2014-4265
    2022-05-20
    oval:com.redhat.rhsa:def:20140902
    P
    		RHSA-2014:0902: java-1.7.0-oracle security update (Critical)
    2017-12-15
    oval:com.redhat.rhsa:def:20140908
    P
    		RHSA-2014:0908: java-1.6.0-sun security update (Important)
    2017-12-15
    oval:org.mitre.oval:def:26480
    V
    		HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities
    2015-04-20
    oval:org.mitre.oval:def:25203
    V
    		Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity (CVE-2014-4265)
    2014-12-01
    oval:org.mitre.oval:def:26705
    P
    		SUSE-SU-2014:1037-1 -- Security update for IBM Java 1.7.0
    2014-10-27
    oval:org.mitre.oval:def:26557
    P
    		SUSE-SU-2014:1055-1 -- Security update for IBM Java
    2014-10-27
    oval:org.mitre.oval:def:26407
    P
    		RHSA-2014:1033: java-1.6.0-ibm security update (Critical)
    2014-10-13
    oval:org.mitre.oval:def:26042
    P
    		RHSA-2014:1041: java-1.7.0-ibm security update (Critical)
    2014-10-13
    oval:org.mitre.oval:def:26182
    P
    		SUSE-SU-2014:0961-1 -- Security update for openjdk
    2014-10-13
    oval:org.mitre.oval:def:25312
    P
    		RHSA-2014:0902: java-1.7.0-oracle security update (Critical)
    2014-09-08
    oval:org.mitre.oval:def:25428
    P
    		RHSA-2014:0908: java-1.6.0-sun security update (Important)
    2014-09-08
    oval:com.redhat.rhsa:def:20141041
    P
    		RHSA-2014:1041: java-1.7.0-ibm security update (Critical)
    2014-08-11
    oval:com.redhat.rhsa:def:20141033
    P
    		RHSA-2014:1033: java-1.6.0-ibm security update (Critical)
    2014-08-07
    oval:com.ubuntu.precise:def:20144265000
    V
    		CVE-2014-4265 on Ubuntu 12.04 LTS (precise) - medium.
    2014-07-17
    oval:com.ubuntu.trusty:def:20144265000
    V
    		CVE-2014-4265 on Ubuntu 14.04 LTS (trusty) - medium.
    2014-07-17
    BACK
    oracle jdk 1.8.0 update5
    oracle jdk 1.7.0 update60
    oracle jdk 1.6.0 update75
    oracle jre 1.6.0 update75
    oracle jre 1.8.0 update5
    oracle jre 1.7.0 update60
    oracle jdk 1.8.0 update5
    oracle jre 1.8.0 update5
    oracle jre 1.7.0 update60
    oracle jdk 1.7.0 update60
    ibm sdk 5.0
    ibm sdk 6.0
    ibm cics transaction gateway 8.0
    redhat enterprise linux server supplementary 6
    redhat enterprise linux workstation supplementary 6
    redhat enterprise linux desktop supplementary 6
    redhat enterprise linux hpc node supplementary 6
    ibm maximo asset management 7.5
    ibm cics transaction gateway 8.1
    ibm cics transaction gateway 9.0
    ibm filenet system monitor 4.5.0
    ibm filenet system monitor 5.1
    ibm tivoli composite application manager 7.3
    ibm maximo asset management 7.1.1
    ibm tivoli composite application manager 7.4
    ibm cognos business viewpoint 10.1
    ibm cognos business viewpoint 10.1.1
    ibm domino 8.5.3.5
    ibm domino 8.5.3.6
    ibm domino 9.0.1
    ibm tivoli endpoint manager *
    ibm i 6.1
    ibm i 7.1
    ibm i 7.2
    ibm tivoli monitoring 6.2.2
    ibm tivoli monitoring 6.2.3
    ibm tivoli monitoring 6.3.0
    ibm tivoli monitoring 6.2.0
    ibm tivoli monitoring 6.2.1
    ibm tivoli application dependency discovery manager 7.2
    ibm tivoli application dependency discovery manager 7.2.1
    ibm tivoli application dependency discovery manager 7.2.2
    ibm cics transaction gateway 9.1
    ibm sdk 6.1
    ibm sdk 7.0
    ibm sdk 7.1