{"id":"CVE-2014-8873","aliases":["DSA-3235-1","DSA-3316-1","EUVD-2014-8703","GHSA-8crp-v9pf-hp45"],"status":"published","title":"A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type...","description":"A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04545,"percentile":0.91634,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2015-04-24T00:00:00Z","modified":"2026-06-17T00:17:28Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"openjdk-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7u79-2.5.5-1~deb7u1"}]}],"versions":["7u13-2.3.6-1","7u15-2.3.7-1","7u17-2.3.8-1","7u17-2.3.8-2","7u21-2.3.9-1","7u21-2.3.9-2","7u21-2.3.9-3","7u21-2.3.9-4","7u21-2.3.9-5","7u21-2.3.9-5+powerpcspe1","7u25-2.3.10-1","7u25-2.3.10-1+alpha","7u25-2.3.10-1~deb7u1","7u25-2.3.10-2","7u25-2.3.10-2+powerpcspe1","7u25-2.3.12-1","7u25-2.3.12-1+alpha","7u25-2.3.12-2","7u25-2.3.12-3","7u25-2.3.12-4","7u25-2.3.12-4+alpha","7u3-2.1.7-1","7u45-2.4.3-1","7u45-2.4.3-2.3","7u45-2.4.3-3","7u45-2.4.3-4","7u45-2.4.3-4+alpha","7u45-2.4.3-4+b1+alpha","7u45-2.4.3-5","7u51-2.4.4-1","7u51-2.4.5-1","7u51-2.4.5-2","7u51-2.4.6-1","7u51-2.4.6~pre1-1","7u55-2.4.7-1","7u55-2.4.7-1~deb7u1","7u55-2.4.7-2","7u60-2.5.0-1","7u60-2.5.0-2","7u65-2.5.1-1","7u65-2.5.1-2","7u65-2.5.1-2~deb7u1","7u65-2.5.1-3","7u65-2.5.1-4","7u65-2.5.1-5","7u65-2.5.1-5~deb7u1","7u65-2.5.2-1","7u65-2.5.2-2","7u65-2.5.2-3","7u65-2.5.2-4","7u65-2.5.2-4.1","7u7-2.3.2-1","7u7-2.3.2a-1","7u71-2.5.3-1","7u71-2.5.3-2","7u71-2.5.3-2~deb7u1","7u75-2.5.4-1","7u75-2.5.4-1~deb7u1","7u75-2.5.4-2","7u75-2.5.4-3","7u9-2.3.3-1","7u9-2.3.4-1","7u9-2.3.5~pre1-1"],"bundled":8},{"source":"osv","ecosystem":"Debian:8","package":"openjdk-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7u79-2.5.5-1~deb8u1"}]}],"versions":["7u75-2.5.4-2","7u75-2.5.4-3","7u79-2.5.5-1~deb7u1"],"bundled":8},{"source":"osv","ecosystem":"Debian:7","package":"openjdk-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7u79-2.5.6-1~deb7u1"}]}],"versions":["7u13-2.3.6-1","7u15-2.3.7-1","7u17-2.3.8-1","7u17-2.3.8-2","7u21-2.3.9-1","7u21-2.3.9-2","7u21-2.3.9-3","7u21-2.3.9-4","7u21-2.3.9-5","7u21-2.3.9-5+powerpcspe1","7u25-2.3.10-1","7u25-2.3.10-1+alpha","7u25-2.3.10-1~deb7u1","7u25-2.3.10-2","7u25-2.3.10-2+powerpcspe1","7u25-2.3.12-1","7u25-2.3.12-1+alpha","7u25-2.3.12-2","7u25-2.3.12-3","7u25-2.3.12-4","7u25-2.3.12-4+alpha","7u3-2.1.7-1","7u45-2.4.3-1","7u45-2.4.3-2.3","7u45-2.4.3-3","7u45-2.4.3-4","7u45-2.4.3-4+alpha","7u45-2.4.3-4+b1+alpha","7u45-2.4.3-5","7u51-2.4.4-1","7u51-2.4.5-1","7u51-2.4.5-2","7u51-2.4.6-1","7u51-2.4.6~pre1-1","7u55-2.4.7-1","7u55-2.4.7-1~deb7u1","7u55-2.4.7-2","7u60-2.5.0-1","7u60-2.5.0-2","7u65-2.5.1-1","7u65-2.5.1-2","7u65-2.5.1-2~deb7u1","7u65-2.5.1-3","7u65-2.5.1-4","7u65-2.5.1-5","7u65-2.5.1-5~deb7u1","7u65-2.5.2-1","7u65-2.5.2-2","7u65-2.5.2-3","7u65-2.5.2-4","7u65-2.5.2-4.1","7u7-2.3.2-1","7u7-2.3.2a-1","7u71-2.5.3-1","7u71-2.5.3-2","7u71-2.5.3-2~deb7u1","7u75-2.5.4-1","7u75-2.5.4-1~deb7u1","7u75-2.5.4-2","7u75-2.5.4-3","7u79-2.5.5-1","7u79-2.5.5-1~deb7u1","7u79-2.5.5-1~deb8u1","7u9-2.3.3-1","7u9-2.3.4-1","7u9-2.3.5~pre1-1"],"bundled":23},{"source":"osv","ecosystem":"Debian:8","package":"openjdk-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7u79-2.5.6-1~deb8u1"}]}],"versions":["7u75-2.5.4-2","7u75-2.5.4-3","7u79-2.5.5-1","7u79-2.5.5-1~deb7u1","7u79-2.5.5-1~deb8u1","7u79-2.5.6-1~deb7u1"],"bundled":23}],"products":[{"vendor":"oracle","product":"openjdk"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3235","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/76019","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2015/07/18/2","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.debian.org/security/2015/dsa-3316","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8873"},{"url":"https://github.com/advisories/GHSA-8crp-v9pf-hp45"}],"sources":{"cve":[{"id":"CVE-2014-8873","description":"A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.","status":"published","published":"2015-11-09T16:00:00Z","modified":"2024-08-06T13:33:11.878Z","updated_at":"2026-11-02T14:33:43.566796Z"}],"euvd":[{"id":"EUVD-2014-8703","description":"A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.","status":"published","published":"2015-11-09T16:00:00Z","modified":"2024-08-06T13:33:11Z","updated_at":"2026-11-03T01:56:50.592563Z"}],"ghsa":[{"id":"GHSA-8crp-v9pf-hp45","title":"A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type...","description":"A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.","status":"published","published":"2022-05-17T04:02:40Z","modified":"2023-01-28T05:00:59Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:43:27.435054Z"}],"nvd":[{"id":"CVE-2014-8873","description":"A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.","status":"published","published":"2015-11-09T16:59:00.103Z","modified":"2026-06-17T00:17:28.153Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"DSA-3235-1","title":"openjdk-7 - security update","status":"published","published":"2015-04-24T00:00:00Z","modified":"2026-03-09T01:22:56.093558Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"DSA-3316-1","title":"openjdk-7 - security update","status":"published","published":"2015-07-25T00:00:00Z","modified":"2026-03-09T01:23:20.738808Z","updated_at":"2026-11-02T15:46:16.199525Z"}]}}