CVE-2014-0878 Weak cryptography in n/a

What is CVE-2014-0878?

CVE-2014-0878 is a medium-severity vulnerability in n/a, published on 26 May 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output.

Weakness: CWE-310

Which versions are affected by CVE-2014-0878?

It affects 1 product.

Products include Ibm Java Sdk.

How do I fix CVE-2014-0878?

Upgrade to a fixed version.

Is CVE-2014-0878 being exploited?

There is no known exploitation of CVE-2014-0878 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2014-8891 Security feature bypass in n/a Critical 10.0
• CVE-2015-5041 Information disclosure in n/a Critical 9.1
• CVE-2018-1417 Privilege escalation in SDK, Java Technology Edition High 8.1
• CVE-2016-0363 Security feature bypass in n/a High 8.1
• CVE-2016-0376 Deserialization in n/a High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v5qx-wfhq-jh75.