CVE catalog

CVE-2014-1876

UBUNTU-CVE-2014-1876

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.46% · Oct 25, 2026

The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuopenjdk-714.047u25-2.3.12-4ubuntu3vulnerable
Ubuntuopenjdk-714.047u25-2.3.12-4ubuntu5vulnerable
Ubuntuopenjdk-714.047u45-2.4.3-3ubuntu1vulnerable
Ubuntuopenjdk-714.047u45-2.4.3-3ubuntu2vulnerable
Ubuntuopenjdk-714.047u45-2.4.3-4ubuntu1vulnerable
Ubuntuopenjdk-714.047u45-2.4.3-4ubuntu2vulnerable
Ubuntuopenjdk-714.047u51-2.4.4-1ubuntu1vulnerable
Ubuntuopenjdk-714.047u51-2.4.5-1ubuntu1vulnerable
Ubuntuopenjdk-714.047u51-2.4.6~pre1-1ubuntu2vulnerable
Ubuntuopenjdk-714.047u51-2.4.6-1ubuntu3vulnerable
Ubuntuopenjdk-714.047u51-2.4.6-1ubuntu4vulnerable
Ubuntuopenjdk-714.047u55-2.4.7-1ubuntu1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntuopenjdk-7deb14.047u55-2.4.7-1ubuntu1Not reportedUBUNTU-CVE-2014-1876Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]