CVE-2014-0428

Name of the Vulnerable Software and Affected Versions Java SE versions 5.0u55, 6u65, and 7u45 Java SE Embedded version 7u45 OpenJDK version 7

Description The issue allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. It is reportedly related to insufficient security checks in IIOP streams, which allows attackers to escape the sandbox. The vulnerability is associated with subcomponents of the program.

Recommendations For Java SE versions 5.0u55, 6u65, and 7u45, update to a version that includes the January 2014 CPU fixes. For Java SE Embedded version 7u45, update to a version that includes the January 2014 CPU fixes. For OpenJDK version 7, update to a version that includes the January 2014 CPU fixes. As a temporary workaround, consider restricting access to the CORBA subcomponent until a patch is available.