CVE-2020-14593: 
NixOS vulnerability analysis and mitigation

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D) affecting Java SE versions 7u261, 8u251, 11.0.7, 14.0.1 and Java SE Embedded version 8u251. This easily exploitable vulnerability allows unauthenticated attackers with network access via multiple protocols to compromise Java SE and Java SE Embedded. The vulnerability requires human interaction from a person other than the attacker (MITRE, NVD).

The vulnerability is related to Affine Transformations in the 2D component. It has a CVSS 3.1 Base Score of 7.4 (High) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N. The vulnerability applies specifically to Java deployments that run sandboxed Java Web Start applications or sandboxed Java applets loading untrusted code from the internet and relying on the Java sandbox for security (Oracle).

Successful exploitation can result in unauthorized creation, deletion or modification access to critical data or all Java SE and Java SE Embedded accessible data. The vulnerability primarily affects the integrity of the system while having no direct impact on confidentiality or availability (MITRE).

The vulnerability is considered easily exploitable, requiring network access and user interaction. It does not apply to Java deployments, typically in servers, that load and run only trusted code installed by an administrator (Oracle).

Oracle has released patches for affected versions in the July 2020 Critical Patch Update. Users should upgrade to the fixed versions: Java SE: 7u261, 8u251, 11.0.7, 14.0.1. For Linux distributions, various patches have been released: Ubuntu users should upgrade to openjdk-11 version 11.0.8+10 or openjdk-8 version 8u265-b01, Debian users should upgrade to version 11.0.8+10-1, and Fedora users should upgrade to java-1.8.0-openjdk version 1.8.0.262.b10 (Ubuntu, Debian).