NVD

Id
30417  
Name
CVE-2014-1876  
Description
The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.  
Reject
 
CVSS Version
2  
CVSS Score
4.4  
Severity
Medium  
CVSS Base Score
4.4  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-02-10  
Modified Date
2016-08-22  
Seq
2014-1876  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
160931 30417 CVE-2014-1876 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562  View
160932 30417 CVE-2014-1876 SSRT101667  View
160933 30417 CVE-2014-1876 SSRT101668  View
160934 30417 CVE-2014-1876 [oss-security] 20140203 CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)  View
160935 30417 CVE-2014-1876 [oss-security] 20140207 Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)  View
160936 30417 CVE-2014-1876 GLSA-201406-32  View
160937 30417 CVE-2014-1876 http://www-01.ibm.com/support/docview.wss?uid=swg21672080  View
160938 30417 CVE-2014-1876 http://www-01.ibm.com/support/docview.wss?uid=swg21676746  View
160939 30417 CVE-2014-1876 http://www-01.ibm.com/support/docview.wss?uid=swg21679713  View
160940 30417 CVE-2014-1876 DSA-2912  View
160941 30417 CVE-2014-1876 http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html  View
160942 30417 CVE-2014-1876 65568  View
160943 30417 CVE-2014-1876 USN-2187-1  View
160944 30417 CVE-2014-1876 USN-2191-1  View
160945 30417 CVE-2014-1876 https://bugzilla.redhat.com/show_bug.cgi?id=1060907  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12482 JVNDB-2014-001357 OpenJDK および Oracle Java JDK の unpack200 における任意のファイルを上書きされる脆弱性 OpenJDK および Oracle Java JDK の unpack200 の unpack.cpp 内の unpacker::redirect_stdio 関数は、ログファイルを開くことができない場合、一時ファイルを安全に作成しないため、任意のファイルを上書きされる脆弱性が存在します。 CVE-2014-1876 69163 CVE-2014-1876 30417 4.4 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001357.html 2014-02-03 2015-03-16 View