CVE-2014-8873
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type...
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.
Exploit likelihood
What each source reports
NVD Score used
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.
- Record
CVE-2014-8873- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.
- Record
CVE-2014-8873- Updated
- 2026-11-02
EUVDEUVD-2014-8703 No score
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.
- Record
EUVD-2014-8703- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8crp-v9pf-hp45 No score
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type...
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.
- Record
GHSA-8crp-v9pf-hp45- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openjdk-7Debian:7 |
before 7u79-2.5.5-1~deb7u1, plus listed versions 7u13-2.3.6-17u15-2.3.7-17u17-2.3.8-17u17-2.3.8-27u21-2.3.9-1 Show 45 moreShow less7u21-2.3.9-27u21-2.3.9-37u21-2.3.9-47u21-2.3.9-57u21-2.3.9-5+powerpcspe17u25-2.3.10-17u25-2.3.10-1+alpha7u25-2.3.10-1~deb7u17u25-2.3.10-27u25-2.3.10-2+powerpcspe17u25-2.3.12-17u25-2.3.12-1+alpha7u25-2.3.12-27u25-2.3.12-37u25-2.3.12-47u25-2.3.12-4+alpha7u3-2.1.7-17u45-2.4.3-17u45-2.4.3-2.37u45-2.4.3-37u45-2.4.3-47u45-2.4.3-4+alpha7u45-2.4.3-4+b1+alpha7u45-2.4.3-57u51-2.4.4-17u51-2.4.5-17u51-2.4.5-27u51-2.4.6-17u51-2.4.6~pre1-17u55-2.4.7-17u55-2.4.7-1~deb7u17u55-2.4.7-27u60-2.5.0-17u60-2.5.0-27u65-2.5.1-17u65-2.5.1-27u65-2.5.1-2~deb7u17u65-2.5.1-37u65-2.5.1-47u65-2.5.1-57u65-2.5.1-5~deb7u17u65-2.5.2-17u65-2.5.2-27u65-2.5.2-37u65-2.5.2-4 |
7u79-2.5.5-1~deb7u1 |
openjdk-7Debian:8 |
before 7u79-2.5.5-1~deb8u1, plus listed versions 7u75-2.5.4-27u75-2.5.4-37u79-2.5.5-1~deb7u1 |
7u79-2.5.5-1~deb8u1 |
openjdk-7Debian:7 |
before 7u79-2.5.6-1~deb7u1, plus listed versions 7u13-2.3.6-17u15-2.3.7-17u17-2.3.8-17u17-2.3.8-27u21-2.3.9-1 Show 45 moreShow less7u21-2.3.9-27u21-2.3.9-37u21-2.3.9-47u21-2.3.9-57u21-2.3.9-5+powerpcspe17u25-2.3.10-17u25-2.3.10-1+alpha7u25-2.3.10-1~deb7u17u25-2.3.10-27u25-2.3.10-2+powerpcspe17u25-2.3.12-17u25-2.3.12-1+alpha7u25-2.3.12-27u25-2.3.12-37u25-2.3.12-47u25-2.3.12-4+alpha7u3-2.1.7-17u45-2.4.3-17u45-2.4.3-2.37u45-2.4.3-37u45-2.4.3-47u45-2.4.3-4+alpha7u45-2.4.3-4+b1+alpha7u45-2.4.3-57u51-2.4.4-17u51-2.4.5-17u51-2.4.5-27u51-2.4.6-17u51-2.4.6~pre1-17u55-2.4.7-17u55-2.4.7-1~deb7u17u55-2.4.7-27u60-2.5.0-17u60-2.5.0-27u65-2.5.1-17u65-2.5.1-27u65-2.5.1-2~deb7u17u65-2.5.1-37u65-2.5.1-47u65-2.5.1-57u65-2.5.1-5~deb7u17u65-2.5.2-17u65-2.5.2-27u65-2.5.2-37u65-2.5.2-4 |
7u79-2.5.6-1~deb7u1 |
openjdk-7Debian:8 |
before 7u79-2.5.6-1~deb8u1, plus listed versions 7u75-2.5.4-27u75-2.5.4-37u79-2.5.5-17u79-2.5.5-1~deb7u17u79-2.5.5-1~deb8u17u79-2.5.6-1~deb7u1 |
7u79-2.5.6-1~deb8u1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8873 is a high vulnerability (CVSS 10.0) in Oracle Openjdk, published April 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.54%, the 91st percentile. Fixed in openjdk-7 7u79-2.5.5-1~deb7u1.
References
Left out here: 29 versions. The JSON record has them.