CVE-2014-0878
Summary
| CVE | CVE-2014-0878 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-05-26 19:55:04 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:P/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Java Sdk | 5.0.0.0 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.11.0 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.11.1 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.11.2 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.12.0 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.12.1 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.12.2 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.12.3 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.12.4 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.12.5 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.13.0 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.14.0 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.15.0 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.16.0 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.16.1 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.16.2 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.16.3 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.16.4 | All | All | All |
| Application | Ibm | Java Sdk | 5.0.16.5 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.0.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.1.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.10.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.10.1 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.11.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.12.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.13.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.13.1 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.13.2 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.14.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.15.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.15.1 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.2.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.3.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.4.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.5.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.6.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.7.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.8.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.8.1 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.9.0 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.9.1 | All | All | All |
| Application | Ibm | Java Sdk | 6.0.9.2 | All | All | All |
| Application | Ibm | Java Sdk | 7.0.0.0 | All | All | All |
| Application | Ibm | Java Sdk | 7.0.1.0 | All | All | All |
| Application | Ibm | Java Sdk | 7.0.2.0 | All | All | All |
| Application | Ibm | Java Sdk | 7.0.3.0 | All | All | All |
| Application | Ibm | Java Sdk | 7.0.4.0 | All | All | All |
| Application | Ibm | Java Sdk | 7.0.4.1 | All | All | All |
| Application | Ibm | Java Sdk | 7.0.4.2 | All | All | All |
| Application | Ibm | Java Sdk | 7.0.5.0 | All | All | All |
| Application | Ibm | Java Sdk | 7.0.6.0 | All | All | All |
| Application | Ibm | Java Sdk | 7.0.6.1 | All | All | All |
| Application | Ibm | Java Sdk | 7.1.0.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM Java SDK CVE-2014-0878 Security Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| IBM Security Bulletin: Rational Insight - IBM SDK, Java Technology Edition Quarterly CPU - April 2014 (CVE-2014-0460, CVE-2014-0878) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Vendor Advisory |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM Security Bulletin: Multiple vulnerabilities in current IBM SDK for Java - April 2014 CPU update for Lotus Quickr 8.5 for WebSphere Portal - United States | af854a3a-2127-422b-91ae-364da2661108 | www.ibm.com | |
| Security Bulletin: Security vulnerabilities in IBM SDK, Java™ Technology Edition (CVE-2014-0878, CVE-2014-0460, CVE-2014-0453, CVE-2014-2420) affect SmartCloud Provisioning | af854a3a-2127-422b-91ae-364da2661108 | www.ibm.com | |
| Security Advisory SA59023 - IBM Multiple Products Java Two Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM Security Bulletin: Multiple vulnerabilities in IBM Multi-Enterprise Integration Gateway (CVE-2014-0460, CVE-2014-0878, CVE-2014-0453) - United States | af854a3a-2127-422b-91ae-364da2661108 | www.ibm.com | |
| IBM notice: The page you requested cannot be displayed | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| IBM Security Bulletin: IBM Operational Decision Manager, WebSphere ILOG JRules and WebSphere Business Events: Multiple security vulnerabilities in IBM JRE - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| IBM Security Bulletin: Two java security vulnerabilities in IBM Security Access Manager for Mobile and IBM Security Access Manager for Web (CVE-2014-0878, CVE-2014-0453) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| IBM Security Bulletin: IBM Lotus Expeditor fixes for multiple vulnerabilities in IBM JRE - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| Security Advisory SA59058 - IBM Lotus Expeditor Multiple Java Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Security Bulletin: Multiple vulnerabilities in the IBM SDK Java Technology Edition component of IBM MessageSight 1.0-1.1 (CVE-2014-0878, CVE-2014-0460 & CVE-2014-0453) | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| Security Bulletin: Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition provided with WebSphere eXtreme Scale | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| Security Advisory SA59022 - IBM API Management Java Two Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology Edition - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Vendor Advisory |
| IBM Security Bulletin: Multiple security vulnerabilities in IBM SDK, Java™ Technology Edition affect IBM SmartCloud Provisioning (CVE-2014-0878, CVE-2014-0460, CVE-2014-0453). - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| IBM SmartCloud Provisioning 2.1 Fix Pack 5 (SCP - 2.1.0.5) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| IBM Security Bulletin: Multiple vulnerabilities in IBM API Management - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| IBM Security Bulletin: AppScan Standard can be affected by vulnerability in the current IBM SDK for Java (CVE-2014-0878, CVE-2014-4244, CVE-2014-4263) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Vendor Advisory |
| Security Bulletin: Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition provided with WebSphere DataPower XC10 Appliance | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.