Bug 1119616 (CVE-2014-4268)

Summary:	CVE-2014-4268 OpenJDK: Missing file choser access restrictions (Swing, 8035699)
Product:	[Other] Security Response	Reporter:	Stefan Cornelius <scorneli>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-07-15 08:12:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1115835

Description Stefan Cornelius 2014-07-15 07:06:42 UTC

It was discovered that the Swing file chooser did not properly
restrict access to files. An untrusted Java application or applet
could possibly use this flaw to gain access to restricted files.

Comment 1 Tomas Hoger 2014-07-15 08:12:01 UTC

This only affected OpenJDK code used on Microsoft Windows platform.  The OpenJDK packages shipped in Red Hat Enterprise Linux or Fedora were not affected by this issue.

Comment 2 Tomas Hoger 2014-08-06 15:53:50 UTC

Upstream OpenJDK commit:
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/756071871d61