1. CVE-Search
  2. CVE-2013-2427
ID CVE-2013-2427
Summary Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than CVE-2013-0402, CVE-2013-2414, and CVE-2013-2428. 1.Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update13:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update13:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update15:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update15:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:2.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:2.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:2.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:2.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:2.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:2.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:2.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:2.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:2.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:2.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:1.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:1.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:1.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:javafx:2.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:javafx:2.2.7:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 19-09-2017 - 01:36)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
oval via4
accepted 2013-06-03T04:03:06.569-04:00
class vulnerability
contributors
name Sergey Artykhov
organization ALTX-SOFT
definition_extensions
  • comment Java SE Runtime Environment 7 is installed
    oval oval:org.mitre.oval:def:16050
  • comment JavaFX 2.x is installed
    oval oval:org.mitre.oval:def:16479
description Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than CVE-2013-0402, CVE-2013-2414, and CVE-2013-2428.
family windows
id oval:org.mitre.oval:def:16536
status accepted
submitted 2013-04-17T10:26:26.748+04:00
title Vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and before and JavaFX 2.2.7 and before. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution.
version 5
redhat via4
advisories
rhsa
id RHSA-2013:0757
rpms
  • java-1.7.0-oracle-1:1.7.0.21-1jpp.1.el5
  • java-1.7.0-oracle-1:1.7.0.21-1jpp.1.el6
  • java-1.7.0-oracle-devel-1:1.7.0.21-1jpp.1.el5
  • java-1.7.0-oracle-javafx-1:1.7.0.21-1jpp.1.el5
  • java-1.7.0-oracle-javafx-1:1.7.0.21-1jpp.1.el6
  • java-1.7.0-oracle-jdbc-1:1.7.0.21-1jpp.1.el5
  • java-1.7.0-oracle-jdbc-1:1.7.0.21-1jpp.1.el6
  • java-1.7.0-oracle-plugin-1:1.7.0.21-1jpp.1.el5
  • java-1.7.0-oracle-plugin-1:1.7.0.21-1jpp.1.el6
  • java-1.7.0-oracle-src-1:1.7.0.21-1jpp.1.el5
  • java-1.7.0-oracle-src-1:1.7.0.21-1jpp.1.el6
refmap via4
cert TA13-107A
confirm http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Last major update 19-09-2017 - 01:36
Published 17-04-2013 - 18:55
Last modified 19-09-2017 - 01:36
Back to Top