ID CVE-2013-2431
Summary Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to bypassing the Java sandbox using "method handle intrinsic frames."
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update13:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update13:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update15:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update15:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 19-09-2017 - 01:36)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
oval via4
accepted 2013-06-03T04:02:54.915-04:00
class vulnerability
contributors
name Sergey Artykhov
organization ALTX-SOFT
definition_extensions
comment Java SE Runtime Environment 7 is installed
oval oval:org.mitre.oval:def:16050
description Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to bypassing the Java sandbox using "method handle intrinsic frames."
family windows
id oval:org.mitre.oval:def:16410
status accepted
submitted 2013-04-17T10:26:26.748+04:00
title Vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and before. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution.
version 6
redhat via4
advisories
  • bugzilla
    id 952711
    title CVE-2013-1569 ICU: Layout Engine font layout and glyph table errors (JDK 2D, 8004994)
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331001
      • OR
        • AND
          • comment java-1.6.0-openjdk is earlier than 1:1.6.0.0-1.40.1.11.11.el5_9
            oval oval:com.redhat.rhsa:tst:20130770002
          • comment java-1.6.0-openjdk is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377003
        • AND
          • comment java-1.6.0-openjdk-demo is earlier than 1:1.6.0.0-1.40.1.11.11.el5_9
            oval oval:com.redhat.rhsa:tst:20130770010
          • comment java-1.6.0-openjdk-demo is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377011
        • AND
          • comment java-1.6.0-openjdk-devel is earlier than 1:1.6.0.0-1.40.1.11.11.el5_9
            oval oval:com.redhat.rhsa:tst:20130770004
          • comment java-1.6.0-openjdk-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377005
        • AND
          • comment java-1.6.0-openjdk-javadoc is earlier than 1:1.6.0.0-1.40.1.11.11.el5_9
            oval oval:com.redhat.rhsa:tst:20130770006
          • comment java-1.6.0-openjdk-javadoc is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377007
        • AND
          • comment java-1.6.0-openjdk-src is earlier than 1:1.6.0.0-1.40.1.11.11.el5_9
            oval oval:com.redhat.rhsa:tst:20130770008
          • comment java-1.6.0-openjdk-src is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377009
    • AND
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhba:tst:20111656001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhba:tst:20111656002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhba:tst:20111656003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhba:tst:20111656004
      • OR
        • AND
          • comment java-1.6.0-openjdk is earlier than 1:1.6.0.0-1.61.1.11.11.el6_4
            oval oval:com.redhat.rhsa:tst:20130770016
          • comment java-1.6.0-openjdk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865006
        • AND
          • comment java-1.6.0-openjdk-demo is earlier than 1:1.6.0.0-1.61.1.11.11.el6_4
            oval oval:com.redhat.rhsa:tst:20130770024
          • comment java-1.6.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865010
        • AND
          • comment java-1.6.0-openjdk-devel is earlier than 1:1.6.0.0-1.61.1.11.11.el6_4
            oval oval:com.redhat.rhsa:tst:20130770022
          • comment java-1.6.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865008
        • AND
          • comment java-1.6.0-openjdk-javadoc is earlier than 1:1.6.0.0-1.61.1.11.11.el6_4
            oval oval:com.redhat.rhsa:tst:20130770020
          • comment java-1.6.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865014
        • AND
          • comment java-1.6.0-openjdk-src is earlier than 1:1.6.0.0-1.61.1.11.11.el6_4
            oval oval:com.redhat.rhsa:tst:20130770018
          • comment java-1.6.0-openjdk-src is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865012
    rhsa
    id RHSA-2013:0770
    released 2013-04-24
    severity Important
    title RHSA-2013:0770: java-1.6.0-openjdk security update (Important)
  • rhsa
    id RHSA-2013:0752
  • rhsa
    id RHSA-2013:0757
rpms
  • java-1.7.0-openjdk-1:1.7.0.19-2.3.9.1.el6_4
  • java-1.7.0-openjdk-demo-1:1.7.0.19-2.3.9.1.el6_4
  • java-1.7.0-openjdk-devel-1:1.7.0.19-2.3.9.1.el6_4
  • java-1.7.0-openjdk-javadoc-1:1.7.0.19-2.3.9.1.el6_4
  • java-1.7.0-openjdk-src-1:1.7.0.19-2.3.9.1.el6_4
  • java-1.7.0-openjdk-1:1.7.0.19-2.3.9.1.el5_9
  • java-1.7.0-openjdk-demo-1:1.7.0.19-2.3.9.1.el5_9
  • java-1.7.0-openjdk-devel-1:1.7.0.19-2.3.9.1.el5_9
  • java-1.7.0-openjdk-javadoc-1:1.7.0.19-2.3.9.1.el5_9
  • java-1.7.0-openjdk-src-1:1.7.0.19-2.3.9.1.el5_9
  • java-1.6.0-openjdk-1:1.6.0.0-1.40.1.11.11.el5_9
  • java-1.6.0-openjdk-demo-1:1.6.0.0-1.40.1.11.11.el5_9
  • java-1.6.0-openjdk-devel-1:1.6.0.0-1.40.1.11.11.el5_9
  • java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.40.1.11.11.el5_9
  • java-1.6.0-openjdk-src-1:1.6.0.0-1.40.1.11.11.el5_9
  • java-1.6.0-openjdk-1:1.6.0.0-1.61.1.11.11.el6_4
  • java-1.6.0-openjdk-demo-1:1.6.0.0-1.61.1.11.11.el6_4
  • java-1.6.0-openjdk-devel-1:1.6.0.0-1.61.1.11.11.el6_4
  • java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.61.1.11.11.el6_4
  • java-1.6.0-openjdk-src-1:1.6.0.0-1.61.1.11.11.el6_4
refmap via4
cert TA13-107A
confirm
gentoo GLSA-201406-32
mandriva
  • MDVSA-2013:145
  • MDVSA-2013:161
misc
mlist [distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released!
suse
  • SUSE-SU-2013:0814
  • openSUSE-SU-2013:0777
  • openSUSE-SU-2013:0964
ubuntu USN-1806-1
Last major update 19-09-2017 - 01:36
Published 17-04-2013 - 18:55
Back to Top