Improper input validation in Java SE Embedded - CVE-2020-14581

Vulnerability identifier: #VU30077

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2020-14581

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Java SE Embedded
Oracle Java SE
Gentoo Linux
Debian Linux
Opensuse
Ubuntu
openEuler
Fedora
IBM Cloud Transformation Advisor
IBM Security Access Manager for Enterprise Single-Sign On
IBM Cloud Pak for Business Automation
IBM Cloud Application Business Insights
IBM Tivoli Monitoring
EMC Data Protection Advisor
openjdk7 (Alpine package)
openjdk8 (Alpine package)
openjdk11 (Alpine package)
java-1.8.0-openjdk
openjdk-8-jdk (Ubuntu package)
openjdk-8-jre-jamvm (Ubuntu package)
openjdk-8-jre (Ubuntu package)
openjdk-8-jre-headless (Ubuntu package)
openjdk-8-jre-zero (Ubuntu package)
openjdk-11-jre-headless (Ubuntu package)
openjdk-11-jre (Ubuntu package)
openjdk-11-jdk (Ubuntu package)
openjdk-11-jre-zero (Ubuntu package)
openjdk-11 (Debian package)
java-11-openjdk
java-latest-openjdk-slowdebug
java-latest-openjdk-devel
java-latest-openjdk-devel-slowdebug
java-latest-openjdk-headless
java-latest-openjdk-headless-slowdebug
java-latest-openjdk-javadoc
java-latest-openjdk-javadoc-zip
java-latest-openjdk-jmods
java-latest-openjdk-jmods-slowdebug
java-latest-openjdk-demo-slowdebug
java-latest-openjdk-src-slowdebug
java-latest-openjdk-src
java-latest-openjdk
java-latest-openjdk-demo
IBM Cloud Pak System
EMC ECS
Dell EMC NetWorker Runtime Environment (NRE)
Solutions Enabler
Unisphere for PowerMax
Unisphere for PowerMax Virtual Appliance
Dell EMC VxRail Appliance
Solutions Enabler Virtual Appliance

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the 2D component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Install updates from vendor's website.

• https://www.oracle.com/security-alerts/cpujul2020.html