CVE-2014-0878

CVE-2014-0878 is a medium-severity vulnerability in Ibm Java Sdk with a CVSS 2.0 base score of 5.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-310.

Key facts

• Severity: Medium (CVSS 2.0 base score 5.8)
• EPSS exploit prediction: 2% (79th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-310
• Affected product: Ibm Java Sdk
• Published: 2014-05-26
• Last modified: 2026-06-17

Description

The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output.

Frequently asked questions

What is CVE-2014-0878?

The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output.

How severe is CVE-2014-0878?

CVE-2014-0878 has a CVSS 2.0 base score of 5.8, rated medium severity.

Is CVE-2014-0878 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (79th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-0878?

CVE-2014-0878 primarily affects Ibm Java Sdk. In total, 53 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-0878?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2014-0878 published?

CVE-2014-0878 was published on 2014-05-26 and last updated on 2026-06-17.

References

• http://secunia.com/advisories/59022
• http://secunia.com/advisories/59023
• http://secunia.com/advisories/59058
• http://secunia.com/advisories/61264
• http://www-01.ibm.com/support/docview.wss?uid=swg21672043
• http://www-01.ibm.com/support/docview.wss?uid=swg21673836
• http://www-01.ibm.com/support/docview.wss?uid=swg21674539
• http://www-01.ibm.com/support/docview.wss?uid=swg21676672
• http://www-01.ibm.com/support/docview.wss?uid=swg21676703
• http://www-01.ibm.com/support/docview.wss?uid=swg21676746
• http://www-01.ibm.com/support/docview.wss?uid=swg21679610
• http://www-01.ibm.com/support/docview.wss?uid=swg21679713
• http://www-01.ibm.com/support/docview.wss?uid=swg21680750
• http://www-01.ibm.com/support/docview.wss?uid=swg21681256
• http://www-01.ibm.com/support/docview.wss?uid=swg21683484
• http://www-01.ibm.com/support/docview.wss?uid=swg21686717
• http://www-01.ibm.com/support/docview.wss?uid=swg21689593
• http://www.ibm.com/support/docview.wss?uid=swg21675343
• http://www.ibm.com/support/docview.wss?uid=swg21675588
• http://www.ibm.com/support/docview.wss?uid=swg21677387
• http://www.securityfocus.com/bid/67601
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91084

Affected products (53)

• cpe:2.3:a:ibm:java_sdk:6.0.0.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.1.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.2.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.3.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.4.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.5.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.6.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.7.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.8.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.8.1:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.9.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.9.1:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.9.2:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.10.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.10.1:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.11.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.12.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.13.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.13.1:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.13.2:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.14.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.15.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:6.0.15.1:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.0.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.11.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.11.1:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.11.2:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.12.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.12.1:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.12.2:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.12.3:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.12.4:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.12.5:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.13.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.14.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.15.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.16.0:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.16.1:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.16.2:*:*:*:technology:*:*:*
• cpe:2.3:a:ibm:java_sdk:5.0.16.3:*:*:*:technology:*:*:*

More vulnerabilities in Ibm Java Sdk

• CVE-2014-8891 — Critical (CVSS 10.0): Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6…
• CVE-2015-5041 — Critical (CVSS 9.1): The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1…
• CVE-2018-1417 — High (CVSS 8.1): Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code…
• CVE-2016-0376 — High (CVSS 8.1): The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6…
• CVE-2016-0363 — High (CVSS 8.1): The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1…
• CVE-2014-8892 — High (CVSS 7.8): Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6…

All CVEs affecting Ibm Java Sdk →

Other CWE-310 (Cryptographic Issues) vulnerabilities

• CVE-2014-7878 — Critical (CVSS 10.0): The Application Lifecycle Service (ALS) in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived…
• CVE-2013-3712 — Critical (CVSS 10.0): SUSE Studio Onsite 1.3.x before 1.3.6 and SUSE Studio Extension for System z 1.3 uses "static" secret tokens, which has…
• CVE-2013-6952 — Critical (CVSS 10.0): The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote…
• CVE-2013-6838 — Critical (CVSS 10.0): An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000)…
• CVE-2013-0137 — Critical (CVSS 10.0): The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189…
• CVE-2011-5123 — Critical (CVSS 10.0): The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not check whether X.509 certificates in…

Browse all CWE-310 (Cryptographic Issues) vulnerabilities →