Bug 1151988 (CVE-2014-6562)
| Summary: | CVE-2014-6562 OpenJDK: incorrect handling of zip entries with NUL in name (Libraries, 8048025) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | unspecified | CC: | dbhole, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-10-17 09:26:04 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1148726 | ||
Public now via Oracle Critical Patch Update - October 2014. Fixed in Oracle Java SE 8u25. External References: http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2014:1636 https://rhn.redhat.com/errata/RHSA-2014-1636.html Upstream OpenJDK commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/2a6df63ca0f0 |
It was discovered that the Libraries component in OpenJDK failed to properly handle ZIP archives that contain entries with NUL byte ('\0') used in the file name. When extracting data from such archives, OpenJDK could use different file than expected. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.