CVE-2014-2490 — OpenJDK: Event logger format string vulnerability (Hotspot, 8037076)

Back Back to CVE browser

HIGH

OpenJDK: Event logger format string vulnerability (Hotspot, 8037076)

Published Jul 17, 2014

9.3

HIGH

CVSS 2.0

EPSS 6.12%

Description

Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

Affected products

Oracle Java for Red Hat Enterprise Linux 5

java-1.7.0-oracle-1:1.7.0.65-1jpp.2.el5_10

Fixed · RHSA-2014:0902
Oracle Java for Red Hat Enterprise Linux 6

java-1.7.0-oracle-1:1.7.0.65-1jpp.1.el6_5

Fixed · RHSA-2014:0902
Oracle Java for Red Hat Enterprise Linux 7

java-1.7.0-oracle-1:1.7.0.65-1jpp.1.el7

Fixed · RHSA-2014:0902
Red Hat Enterprise Linux 5

java-1.6.0-openjdk-1:1.6.0.0-6.1.13.4.el5_10

Fixed · RHSA-2014:0907
Red Hat Enterprise Linux 5

java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el5_10

Fixed · RHSA-2014:0890
Red Hat Enterprise Linux 6

java-1.6.0-openjdk-1:1.6.0.0-6.1.13.4.el6_5

Fixed · RHSA-2014:0907
Red Hat Enterprise Linux 6

java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el6_5

Fixed · RHSA-2014:0889
Red Hat Enterprise Linux 7

java-1.6.0-openjdk-1:1.6.0.0-6.1.13.4.el7_0

Fixed · RHSA-2014:0907
Red Hat Enterprise Linux 7

java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el7_0

Fixed · RHSA-2014:0889
Red Hat Enterprise Linux 5

java-1.6.0-sun

Not affected
Red Hat Enterprise Linux 6

java-1.6.0-sun

Not affected
Red Hat Enterprise Linux 7

java-1.6.0-sun

Not affected

Product	Package	State	Advisory
Oracle Java for Red Hat Enterprise Linux 5	java-1.7.0-oracle-1:1.7.0.65-1jpp.2.el5_10	Fixed	RHSA-2014:0902
Oracle Java for Red Hat Enterprise Linux 6	java-1.7.0-oracle-1:1.7.0.65-1jpp.1.el6_5	Fixed	RHSA-2014:0902
Oracle Java for Red Hat Enterprise Linux 7	java-1.7.0-oracle-1:1.7.0.65-1jpp.1.el7	Fixed	RHSA-2014:0902
Red Hat Enterprise Linux 5	java-1.6.0-openjdk-1:1.6.0.0-6.1.13.4.el5_10	Fixed	RHSA-2014:0907
Red Hat Enterprise Linux 5	java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el5_10	Fixed	RHSA-2014:0890
Red Hat Enterprise Linux 6	java-1.6.0-openjdk-1:1.6.0.0-6.1.13.4.el6_5	Fixed	RHSA-2014:0907
Red Hat Enterprise Linux 6	java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el6_5	Fixed	RHSA-2014:0889
Red Hat Enterprise Linux 7	java-1.6.0-openjdk-1:1.6.0.0-6.1.13.4.el7_0	Fixed	RHSA-2014:0907
Red Hat Enterprise Linux 7	java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el7_0	Fixed	RHSA-2014:0889
Red Hat Enterprise Linux 5	java-1.6.0-sun	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.6.0-sun	Not affected	n/a
Red Hat Enterprise Linux 7	java-1.6.0-sun	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

6.12% 0.06118

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.06118

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (23 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	6.12% (0.06118)	93.23th	v5 (v2026.06.15)
Jun 15, 2026	6.12% (0.06118)	92.49th	v5 (v2026.06.15)
May 2, 2026	4.88% (0.04879)	89.61th	v4 (v2025.03.14)
Dec 28, 2025	3.11% (0.03114)	86.41th	v4 (v2025.03.14)
Dec 27, 2025	4.44% (0.04441)	88.72th	v4 (v2025.03.14)
Oct 28, 2025	3.10% (0.03103)	86.28th	v4 (v2025.03.14)
Oct 27, 2025	5.89% (0.05891)	90.21th	v4 (v2025.03.14)
Oct 1, 2025	3.10% (0.03103)	86.36th	v4 (v2025.03.14)
Aug 20, 2025	5.89% (0.05891)	90.23th	v4 (v2025.03.14)
May 18, 2025	7.31% (0.07313)	91.18th	v4 (v2025.03.14)
Apr 3, 2025	6.30% (0.06300)	90.03th	v4 (v2025.03.14)
Mar 30, 2025	7.31% (0.07313)	90.82th	v4 (v2025.03.14)
Mar 29, 2025	15.08% (0.15078)	91.00th	v4 (v2025.03.14)
Mar 17, 2025	7.31% (0.07313)	91.01th	v4 (v2025.03.14)
Dec 17, 2024	9.90% (0.09897)	94.85th	v3 (v2023.03.01)
Dec 12, 2024	2.68% (0.02684)	90.82th	v3 (v2023.03.01)
Feb 27, 2024	2.04% (0.02042)	88.64th	v3 (v2023.03.01)
Jan 10, 2024	1.87% (0.01867)	87.09th	v3 (v2023.03.01)
Aug 10, 2023	1.85% (0.01854)	86.84th	v3 (v2023.03.01)
Mar 7, 2023	2.17% (0.02173)	87.57th	v3 (v2023.03.01)
Mar 6, 2023	3.78% (0.03779)	85.48th	v2 (v2022.01.01)
Apr 1, 2022	3.78% (0.03779)	84.01th	v2 (v2022.01.01)
Feb 4, 2022	3.78% (0.03779)	67.21th	v2 (v2022.01.01)

Weaknesses (1)

CWE-134

References (19)

http://marc.info/?l=bugtraq&m=140852886808946&w=2
vendor-advisoryx_refsource_HPThird Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/23
mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
http://secunia.com/advisories/60129
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/60485
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/60812
third-party-advisoryx_refsource_SECUNIA
http://security.gentoo.org/glsa/glsa-201502-12.xml
vendor-advisoryx_refsource_GENTOOThird Party Advisory
http://www.debian.org/security/2014/dsa-2980
vendor-advisoryx_refsource_DEBIANThird Party Advisory
http://www.debian.org/security/2014/dsa-2987
vendor-advisoryx_refsource_DEBIANThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
x_refsource_CONFIRMVendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html#AppendixJAVA
http://www.securityfocus.com/archive/1/534161/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/68645
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1030577
vdb-entryx_refsource_SECTRACK
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
x_refsource_CONFIRMThird Party Advisory
https://access.redhat.com/errata/RHSA-2014:0902
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2014-2490
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1119597
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2014-2490
https://www.cve.org/CVERecord?id=CVE-2014-2490

Link	Providers	Tags
http://marc.info/?l=bugtraq&m=140852886808946&w=2		vendor-advisoryx_refsource_HPThird Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/23		mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
http://secunia.com/advisories/60129		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/60485		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/60812		third-party-advisoryx_refsource_SECUNIA
http://security.gentoo.org/glsa/glsa-201502-12.xml		vendor-advisoryx_refsource_GENTOOThird Party Advisory
http://www.debian.org/security/2014/dsa-2980		vendor-advisoryx_refsource_DEBIANThird Party Advisory
http://www.debian.org/security/2014/dsa-2987		vendor-advisoryx_refsource_DEBIANThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html		x_refsource_CONFIRMVendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html#AppendixJAVA
http://www.securityfocus.com/archive/1/534161/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/68645		vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1030577		vdb-entryx_refsource_SECTRACK
http://www.vmware.com/security/advisories/VMSA-2014-0012.html		x_refsource_CONFIRMThird Party Advisory
https://access.redhat.com/errata/RHSA-2014:0902		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2014-2490		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1119597		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2014-2490
https://www.cve.org/CVERecord?id=CVE-2014-2490

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner oracle

Published Jul 17, 2014

Updated Aug 6, 2024

Reserved Mar 13, 2014

Link CVE-2014-2490

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2014-2490

Red Hat

Severity Critical

Public date Jul 15, 2014

Links CVE-2014-2490 - Bugzilla