CVE-2014-0376

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 5.0u55 through 7u45 Java SE Embedded version 7u45 OpenJDK 7

Description The issue allows remote attackers to affect the integrity of data via vectors related to JAXP. It is reportedly related to an improper check for code permissions when creating document builder factories, which could allow a remote attacker to compromise the confidentiality, integrity, and availability of data.

Recommendations For Oracle Java SE versions 5.0u55 through 7u45, update to a version that is not affected by this issue. For Java SE Embedded version 7u45, update to a version that is not affected by this issue. For OpenJDK 7, update to a version that is not affected by this issue. As a temporary workaround, consider restricting the use of the JAXP subcomponent until a patch is available.