// For flags

CVE-2014-6591

ICU: font parsing OOB read (OpenJDK 2D, 8056276)

Severity Score

2.6
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585.

Vulnerabilidad no especificada en el componente Java SE en Oracle Java SE 5.0u75, 6u85, 7u72, y 8u25 permite a atacantes remotos afectar la confidencialidad a través de vectores desconocidos relacionados con 2D, una vulnerabilidad diferente a CVE-2014-6585.

A boundary check flaw was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2014-09-17 CVE Reserved
  • 2015-01-21 CVE Published
  • 2024-08-06 CVE Updated
  • 2024-09-02 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-125: Out-of-bounds Read
CAPEC
References (27)
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
Jdk
Search vendor "Oracle" for product "Jdk"
1.5.0
Search vendor "Oracle" for product "Jdk" and version "1.5.0"
update75
Affected
Oracle
Search vendor "Oracle"
Jdk
Search vendor "Oracle" for product "Jdk"
1.6.0
Search vendor "Oracle" for product "Jdk" and version "1.6.0"
update85
Affected
Oracle
Search vendor "Oracle"
Jdk
Search vendor "Oracle" for product "Jdk"
1.7.0
Search vendor "Oracle" for product "Jdk" and version "1.7.0"
update72
Affected
Oracle
Search vendor "Oracle"
Jdk
Search vendor "Oracle" for product "Jdk"
1.8.0
Search vendor "Oracle" for product "Jdk" and version "1.8.0"
update25
Affected
Oracle
Search vendor "Oracle"
Jre
Search vendor "Oracle" for product "Jre"
1.5.0
Search vendor "Oracle" for product "Jre" and version "1.5.0"
update75
Affected
Oracle
Search vendor "Oracle"
Jre
Search vendor "Oracle" for product "Jre"
1.6.0
Search vendor "Oracle" for product "Jre" and version "1.6.0"
update85
Affected
Oracle
Search vendor "Oracle"
Jre
Search vendor "Oracle" for product "Jre"
1.7.0
Search vendor "Oracle" for product "Jre" and version "1.7.0"
update72
Affected
Oracle
Search vendor "Oracle"
Jre
Search vendor "Oracle" for product "Jre"
1.8.0
Search vendor "Oracle" for product "Jre" and version "1.8.0"
update25
Affected