{"id":"CVE-2014-4263","description":"Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to \"Diffie-Hellman key agreement.\"","cvssScore":4,"cvssVersion":"2.0","cvssVector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","cvssMetrics":[{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"resolved":"NO-EXPLOIT-PUBLISHED","published":"2014-07-17","lastModified":"2026-06-17","affectedProducts":[{"vendor":"oracle","product":"jrockit","version":"r27.8.2"},{"vendor":"oracle","product":"jrockit","version":"r28.3.2"},{"vendor":"oracle","product":"jdk","version":"1.5.0","update":"update65"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update75"},{"vendor":"oracle","product":"jdk","version":"1.7.0","update":"update60"},{"vendor":"oracle","product":"jdk","version":"1.8.0","update":"update5"},{"vendor":"oracle","product":"jre","version":"1.5.0","update":"update65"},{"vendor":"oracle","product":"jre","version":"1.6.0","update":"update75"},{"vendor":"oracle","product":"jre","version":"1.7.0","update":"update60"},{"vendor":"oracle","product":"jre","version":"1.8.0","update":"update5"}],"totalAffectedProducts":3,"references":[{"url":"https://access.redhat.com/security/cve/CVE-2014-4263","source":"patch-hint","tags":["redhat-cve"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0889","source":"redhat","tags":["ADVISORY","RHSA-2014:0889"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0890","source":"redhat","tags":["ADVISORY","RHSA-2014:0890"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0907","source":"redhat","tags":["ADVISORY","RHSA-2014:0907"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html","source":"secalert_us@oracle.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.html","source":"secalert_us@oracle.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html","source":"secalert_us@oracle.com"},{"url":"http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2","source":"secalert_us@oracle.com"},{"url":"http://marc.info/?l=bugtraq\u0026m=140852974709252\u0026w=2","source":"secalert_us@oracle.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0264.html","source":"secalert_us@oracle.com"}],"reasoning":{"decidingSource":"no-exploit-published","decidingReason":"This CVE is not listed in CISA KEV, CISA Vulnrichment records no active exploitation, and no reviewed exploit catalogue carries an entry for it. Nobody has published something a stranger can run, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious.","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"no-match"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"no-match"},{"rule":"osv-maven","stage":"scope","outcome":"no-match"},{"rule":"cna-maven-package","stage":"scope","outcome":"no-match"},{"rule":"known-cpe-product","stage":"scope","outcome":"matched","status":"QUEUED-FOR-REVIEW","detail":"Matches known products: oracle/jrockit, oracle/jdk, oracle/jre"},{"rule":"patch-hint","stage":"disposition","outcome":"matched","status":"MITIGATION-CANDIDATE","detail":"References include candidate fix URL (redhat-cve tier): https://access.redhat.com/security/cve/CVE-2014-4263 (from RHSA-2014:0889)"},{"rule":"open-source-maven","stage":"disposition","outcome":"skipped"},{"rule":"poc-derivable","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit","stage":"disposition","outcome":"skipped"},{"rule":"secure-rule-match","stage":"disposition","outcome":"no-match"},{"rule":"below-action-threshold","stage":"disposition","outcome":"withheld","detail":"CVE ships in Oracle Critical Patch Update July 2014 (CPU) — Oracle treats it as urgent, so severity does not settle it"},{"rule":"no-exploit-published","stage":"disposition","outcome":"matched","status":"NO-EXPLOIT-PUBLISHED","detail":"No working exploit has been published, and an upstream fix path does exist, so the remediation half of the candidacy still holds.","decisive":true}],"patchHintUrl":"https://access.redhat.com/security/cve/CVE-2014-4263","patchHintTier":"redhat-cve","affectedProducts":[{"vendor":"oracle","product":"jrockit","isKnown":true,"cpe":"cpe:2.3:a:oracle:jrockit:r27.8.2:*:*:*:*:*:*:*","source":"yaml"},{"vendor":"oracle","product":"jdk","isKnown":true,"cpe":"cpe:2.3:a:oracle:jdk:1.5.0:update65:*:*:*:*:*:*","source":"yaml"},{"vendor":"oracle","product":"jre","isKnown":true,"cpe":"cpe:2.3:a:oracle:jre:1.5.0:update65:*:*:*:*:*:*","source":"yaml"}]},"oracleAdvisories":[{"advisory":"Oracle Critical Patch Update July 2014","releaseType":"CPU","quarter":"2014-Q3","url":"https://www.oracle.com/security-alerts/cpujul2014.html","products":[{"product":"Oracle Java SE","component":"Security","affectedVersions":"Java SE 5.0u65, Java SE 6u75, Java SE 7u60, Java SE 8u5, JRockit R27.8.2, JRockit R28.3.2"}]}],"assessment":{"record":{"state":"active"},"protection":{"level":"none"},"action":{"state":"unverified","type":"patch-rule"},"review":{"state":"automated","basis":"upstream-data"}},"signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.03501,"percentile":0.88528},"ssvc":{"available":false},"patchHintUrl":"https://access.redhat.com/security/cve/CVE-2014-4263","patchHintTier":"redhat-cve"}