製品・ソフトウェアに関する情報

JVN脆弱性詳細

Oracle Java SE における 2D に関する脆弱性

Title	Oracle Java SE における 2D に関する脆弱性
Summary	Oracle Java SE には、2D に関する処理に不備があるため、機密性に影響のある脆弱性が存在します。
Possible impacts	第三者により、情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 14, 2014, midnight
Registration Date	Oct. 16, 2014, 4:28 p.m.
Last Update	Jan. 28, 2016, 11:43 a.m.

CVSS2.0 : 警告
Score	5
Vector	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected System

オラクル

JDK 5.0 Update 71 およびそれ以前

JDK 6 Update 81 およびそれ以前

JDK 7 Update 67 およびそれ以前

JDK 8 Update 20 およびそれ以前

JDK 5.0 Update 71 およびそれ以前

JDK 6 Update 81 およびそれ以前

JDK 7 Update 67 およびそれ以前

JDK 8 Update 20 およびそれ以前

JRE 5.0 Update 71 およびそれ以前

JRE 6 Update 81 およびそれ以前

JRE 7 Update 67 およびそれ以前

JRE 8 Update 20 およびそれ以前

JRE 5.0 Update 71 およびそれ以前

JRE 6 Update 81 およびそれ以前

JRE 7 Update 67 およびそれ以前

JRE 8 Update 20 およびそれ以前

日立

Cosminexus Application Server Enterprise Version 6

Cosminexus Application Server Standard Version 6

Cosminexus Application Server Version 5

Cosminexus Client Version 6

Cosminexus Developer Light Version 6

Cosminexus Developer Professional Version 6

Cosminexus Developer Standard Version 6

Cosminexus Developer Version 5

Cosminexus Developer's Kit for Java(TM)

Cosminexus Primary Server Base

Cosminexus Studio Version 5

Hitachi Application Server

Hitachi Application Server for Developers

Hitachi Developer's Kit for Java

uCosminexus Application Server -R

uCosminexus Application Server Express

uCosminexus Application Server Light

uCosminexus Application Server Standard-R

uCosminexus Application Server -R

uCosminexus Application Server Express

uCosminexus Application Server Light

uCosminexus Application Server Standard-R

uCosminexus Application Server Enterprise

uCosminexus Application Server Smart Edition

uCosminexus Application Server Standard

uCosminexus Client

uCosminexus Client for Plug-in

uCosminexus Client

uCosminexus Client for Plug-in

uCosminexus Developer 01

uCosminexus Developer Professional

uCosminexus Developer Professional for Plug-in

uCosminexus Developer 01

uCosminexus Developer Professional

uCosminexus Developer Professional for Plug-in

uCosminexus Developer Light

uCosminexus Developer Standard

uCosminexus Operator

uCosminexus Primary Server Base

uCosminexus Server Standard-R

uCosminexus Service Architect

uCosminexus Service Platform

uCosminexus Service Platform - Messaging

uCosminexus Service Platform

uCosminexus Service Platform - Messaging

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-6511	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6511
2	CVE-2014-6511	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6511
National Vulnerability Database (NVD)
3	CVE-2014-6511	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6511
4	CVE-2014-6511	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6511

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo
2	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Hitachi Software Vulnerability Information
1	HS14-021	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-021/index.html
2	HS14-021	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-021/index.html
HP Security Bulletin
3	HPSBUX03218 SSRT101770	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04517477
4	HPSBUX03218 SSRT101770	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04517477
IBM Support Document
5	1688283	http://www-01.ibm.com/support/docview.wss?uid=swg21688283
6	1688283	http://www-01.ibm.com/support/docview.wss?uid=swg21688283
Oracle
7	ELSA-2014-1633	http://linux.oracle.com/errata/ELSA-2014-1633.html
8	ELSA-2014-1633	http://linux.oracle.com/errata/ELSA-2014-1633.html
9	ELSA-2014-1634	http://linux.oracle.com/errata/ELSA-2014-1634.html
10	ELSA-2014-1634	http://linux.oracle.com/errata/ELSA-2014-1634.html
11	ELSA-2014-1636	http://linux.oracle.com/errata/ELSA-2014-1636.html
12	ELSA-2014-1636	http://linux.oracle.com/errata/ELSA-2014-1636.html
Oracle Critical Patch Update
13	Oracle Critical Patch Update Advisory - October 2014	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
14	Oracle Critical Patch Update Advisory - October 2014	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
15	Text Form of Oracle Critical Patch Update - October 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuoct2014verbose-1972962.html
16	Text Form of Oracle Critical Patch Update - October 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuoct2014verbose-1972962.html
Oracle Technology Network
17	Oracle Solaris Third Party Bulletin - July 2015	http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
18	Oracle Solaris Third Party Bulletin - July 2015	http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
Red Hat Security Advisory
19	RHSA-2014:1620	https://rhn.redhat.com/errata/RHSA-2014-1620.html
20	RHSA-2014:1620	https://rhn.redhat.com/errata/RHSA-2014-1620.html
21	RHSA-2014:1633	https://rhn.redhat.com/errata/RHSA-2014-1633.html
22	RHSA-2014:1633	https://rhn.redhat.com/errata/RHSA-2014-1633.html
23	RHSA-2014:1634	https://rhn.redhat.com/errata/RHSA-2014-1634.html
24	RHSA-2014:1634	https://rhn.redhat.com/errata/RHSA-2014-1634.html
25	RHSA-2014:1636	https://rhn.redhat.com/errata/RHSA-2014-1636.html
26	RHSA-2014:1636	https://rhn.redhat.com/errata/RHSA-2014-1636.html
27	RHSA-2014:1657	https://rhn.redhat.com/errata/RHSA-2014-1657.html
28	RHSA-2014:1657	https://rhn.redhat.com/errata/RHSA-2014-1657.html
29	RHSA-2014:1658	https://rhn.redhat.com/errata/RHSA-2014-1658.html
30	RHSA-2014:1658	https://rhn.redhat.com/errata/RHSA-2014-1658.html
31	RHSA-2014:1876	http://rhn.redhat.com/errata/RHSA-2014-1876.html
32	RHSA-2014:1876	http://rhn.redhat.com/errata/RHSA-2014-1876.html
33	RHSA-2014:1877	http://rhn.redhat.com/errata/RHSA-2014-1877.html
34	RHSA-2014:1877	http://rhn.redhat.com/errata/RHSA-2014-1877.html
35	RHSA-2014:1880	http://rhn.redhat.com/errata/RHSA-2014-1880.html
36	RHSA-2014:1880	http://rhn.redhat.com/errata/RHSA-2014-1880.html
37	RHSA-2014:1881	http://rhn.redhat.com/errata/RHSA-2014-1881.html
38	RHSA-2014:1881	http://rhn.redhat.com/errata/RHSA-2014-1881.html
39	RHSA-2014:1882	http://rhn.redhat.com/errata/RHSA-2014-1882.html
40	RHSA-2014:1882	http://rhn.redhat.com/errata/RHSA-2014-1882.html
41	RHSA-2015:0264	https://rhn.redhat.com/errata/RHSA-2015-0264.html
42	RHSA-2015:0264	https://rhn.redhat.com/errata/RHSA-2015-0264.html
SECURITY BLOG
43	October 2014 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2014_critical_patch_update
44	October 2014 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2014_critical_patch_update
ソフトウェア製品セキュリティ情報
45	HS14-021	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-021/index.html http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-021/index.html
46	HS14-021	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-021/index.html http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-021/index.html
富士通セキュリティ情報
47	Oracle Corporation Javaプラグインの脆弱性に関するお知らせ	http://www.fmworld.net/biz/common/oracle/20141016.html
48	Oracle Corporation Javaプラグインの脆弱性に関するお知らせ	http://www.fmworld.net/biz/common/oracle/20141016.html

その他

No	Name	URL
IPA 重要なセキュリティ情報
1	Oracle Java の脆弱性対策について(CVE-2014-6513等)	http://www.ipa.go.jp/security/ciadr/vul/20141015-jre.html
2	Oracle Java の脆弱性対策について(CVE-2014-6513等)	http://www.ipa.go.jp/security/ciadr/vul/20141015-jre.html
JPCERT 注意喚起
3	JPCERT-AT-2014-0041	http://www.jpcert.or.jp/at/2014/at140041.html
4	JPCERT-AT-2014-0041	http://www.jpcert.or.jp/at/2014/at140041.html

Change Log

No	Changed Details	Date of change
0	[2014年10月16日] 掲載 [2014年10月21日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：日立 (HS14-021) を追加 [2014年11月17日] ベンダ情報：レッドハット (RHSA-2014:1657) を追加ベンダ情報：レッドハット (RHSA-2014:1658) を追加 [2014年11月21日] ベンダ情報：レッドハット (RHSA-2014:1620) を追加ベンダ情報：レッドハット (RHSA-2014:1633) を追加ベンダ情報：レッドハット (RHSA-2014:1634) を追加ベンダ情報：レッドハット (RHSA-2014:1636) を追加ベンダ情報：オラクル (ELSA-2014-1633) を追加ベンダ情報：オラクル (ELSA-2014-1634) を追加ベンダ情報：オラクル (ELSA-2014-1636) を追加 [2014年12月08日] ベンダ情報：IBM (1688283) を追加 [2014年12月17日] ベンダ情報：レッドハット (RHSA-2014:1876) を追加ベンダ情報：レッドハット (RHSA-2014:1877) を追加ベンダ情報：レッドハット (RHSA-2014:1880) を追加ベンダ情報：レッドハット (RHSA-2014:1881) を追加ベンダ情報：レッドハット (RHSA-2014:1882) を追加ベンダ情報：ヒューレット・パッカード (HPSBUX03218 SSRT101770) を追加 [2015年03月16日] 影響を受けるシステム：内容を更新 [2015年05月26日] ベンダ情報：レッドハット (RHSA-2015:0264) を追加 [2015年07月31日] ベンダ情報：オラクル (Oracle Solaris Third Party Bulletin - July 2015) を追加 [2016年01月28日] 影響を受けるシステム：ベンダ情報の更新に伴い内容を更新	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2014-6511

Summary	Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Publication Date	Oct. 16, 2014, 7:55 a.m.
Registration Date	Jan. 26, 2021, 3:16 p.m.
Last Update	Nov. 21, 2024, 11:14 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk:1.5.0:update_71::::::
cpe:2.3:a:oracle:jre:1.8.0:update_20::::::
cpe:2.3:a:oracle:jre:1.5.0:update_71::::::
cpe:2.3:a:oracle:jre:1.7.0:update_67::::::
cpe:2.3:a:oracle:jre:1.6.0:update_81::::::
cpe:2.3:a:oracle:jdk:1.6.0:update81::::::

Related information, measures and tools

No	URL	タグ
1	http://linux.oracle.com/errata/ELSA-2014-1633.html
2	http://linux.oracle.com/errata/ELSA-2014-1633.html
3	http://linux.oracle.com/errata/ELSA-2014-1634.html
4	http://linux.oracle.com/errata/ELSA-2014-1634.html
5	http://linux.oracle.com/errata/ELSA-2014-1636
6	http://linux.oracle.com/errata/ELSA-2014-1636
7	http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00013.html
8	http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00013.html
9	http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00021.html
10	http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00021.html
11	http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00002.html
12	http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00002.html
13	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html
14	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html
15	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00027.html
16	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00027.html
17	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.html
18	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.html
19	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html
20	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html
21	http://marc.info/?l=bugtraq&m=141775382904016&w=2
22	http://marc.info/?l=bugtraq&m=141775382904016&w=2
23	http://marc.info/?l=bugtraq&m=141775382904016&w=2
24	http://marc.info/?l=bugtraq&m=141775382904016&w=2
25	http://rhn.redhat.com/errata/RHSA-2014-1620.html
26	http://rhn.redhat.com/errata/RHSA-2014-1620.html
27	http://rhn.redhat.com/errata/RHSA-2014-1633.html
28	http://rhn.redhat.com/errata/RHSA-2014-1633.html
29	http://rhn.redhat.com/errata/RHSA-2014-1634.html
30	http://rhn.redhat.com/errata/RHSA-2014-1634.html
31	http://rhn.redhat.com/errata/RHSA-2014-1636.html
32	http://rhn.redhat.com/errata/RHSA-2014-1636.html
33	http://rhn.redhat.com/errata/RHSA-2014-1657.html
34	http://rhn.redhat.com/errata/RHSA-2014-1657.html
35	http://rhn.redhat.com/errata/RHSA-2014-1658.html
36	http://rhn.redhat.com/errata/RHSA-2014-1658.html
37	http://rhn.redhat.com/errata/RHSA-2014-1876.html
38	http://rhn.redhat.com/errata/RHSA-2014-1876.html
39	http://rhn.redhat.com/errata/RHSA-2014-1877.html
40	http://rhn.redhat.com/errata/RHSA-2014-1877.html
41	http://rhn.redhat.com/errata/RHSA-2014-1880.html
42	http://rhn.redhat.com/errata/RHSA-2014-1880.html
43	http://rhn.redhat.com/errata/RHSA-2014-1881.html
44	http://rhn.redhat.com/errata/RHSA-2014-1881.html
45	http://rhn.redhat.com/errata/RHSA-2014-1882.html
46	http://rhn.redhat.com/errata/RHSA-2014-1882.html
47	http://rhn.redhat.com/errata/RHSA-2015-0264.html
48	http://rhn.redhat.com/errata/RHSA-2015-0264.html
49	http://secunia.com/advisories/60414
50	http://secunia.com/advisories/60414
51	http://secunia.com/advisories/60416
52	http://secunia.com/advisories/60416
53	http://secunia.com/advisories/60417
54	http://secunia.com/advisories/60417
55	http://secunia.com/advisories/61018
56	http://secunia.com/advisories/61018
57	http://secunia.com/advisories/61020
58	http://secunia.com/advisories/61020
59	http://secunia.com/advisories/61143
60	http://secunia.com/advisories/61143
61	http://secunia.com/advisories/61163
62	http://secunia.com/advisories/61163
63	http://secunia.com/advisories/61164
64	http://secunia.com/advisories/61164
65	http://secunia.com/advisories/61346
66	http://secunia.com/advisories/61346
67	http://secunia.com/advisories/61609
68	http://secunia.com/advisories/61609
69	http://secunia.com/advisories/61928
70	http://secunia.com/advisories/61928
71	http://security.gentoo.org/glsa/glsa-201502-12.xml
72	http://security.gentoo.org/glsa/glsa-201502-12.xml
73	http://www.debian.org/security/2014/dsa-3077
74	http://www.debian.org/security/2014/dsa-3077
75	http://www.debian.org/security/2014/dsa-3080
76	http://www.debian.org/security/2014/dsa-3080
77	http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
78	http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
79	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html	Patch Vendor Advisory
80	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html	Patch Vendor Advisory
81	http://www.securityfocus.com/bid/70548
82	http://www.securityfocus.com/bid/70548
83	http://www.ubuntu.com/usn/USN-2386-1
84	http://www.ubuntu.com/usn/USN-2386-1
85	http://www.ubuntu.com/usn/USN-2388-1
86	http://www.ubuntu.com/usn/USN-2388-1
87	http://www.ubuntu.com/usn/USN-2388-2
88	http://www.ubuntu.com/usn/USN-2388-2
89	http://www-01.ibm.com/support/docview.wss?uid=swg21688283
90	http://www-01.ibm.com/support/docview.wss?uid=swg21688283

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk:1.5.0:update_71::::::
cpe:2.3:a:oracle:jre:1.8.0:update_20::::::
cpe:2.3:a:oracle:jre:1.5.0:update_71::::::
cpe:2.3:a:oracle:jre:1.7.0:update_67::::::
cpe:2.3:a:oracle:jre:1.6.0:update_81::::::
cpe:2.3:a:oracle:jdk:1.6.0:update81::::::