CVE-2014-1876
The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.
- Affected products
- Centos, Hp-Ux, Ibm Aix, Jrockit, Java Platform, Java Se, Java Se Embedded, Openjdk
- Oracle Openjdk
- = 1.6.0, 1.7.0, 1.8.0
- Fix
- Available
- CVSS 2.0
- 4.4 MEDIUM
- EPSS
- 0.5% (37th percentile)
- Weakness
- CWE-59
- NVD status
- Modified
- Published
- 2014-02-10
CVE-2014-1876 at NVD
No indexed exploits for CVE-2014-1876 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2014-1876 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.