CVE-2014-2402

Name	CVE-2014-2402
Description	Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-0455.
Source	CVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
References	DSA-2923-1
NVD severity	high (attack range: remote)
Debian/oldstable	not vulnerable.
Debian/stable	package openjdk-7 is vulnerable.
Debian/testing	not vulnerable.
Debian/unstable	not vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openjdk-6 (PTS)	squeeze	6b18-1.8.13-0+squeeze2	fixed
	squeeze (security)	6b31-1.13.3-1~deb6u1	fixed
	squeeze (lts)	6b34-1.13.6-1~deb6u1	fixed
	wheezy	6b27-1.12.5-1	fixed
	wheezy (security)	6b34-1.13.6-1~deb7u1	fixed
	sid	6b34-1.13.6-1	fixed
openjdk-7 (PTS)	wheezy	7u3-2.1.7-1	vulnerable
	wheezy (security)	7u75-2.5.4-1~deb7u1	fixed
	jessie	7u71-2.5.3-2	fixed
	sid	7u75-2.5.4-2	fixed

The information above is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
openjdk-6	source	(unstable)	(not affected)
openjdk-7	source	(unstable)	7u55-2.4.7-1	high
openjdk-7	source	wheezy	7u55-2.4.7-1~deb7u1	high	DSA-2923-1

- openjdk-6 <not-affected> (Only affects Java 7/8)