CVE-2013-2465

CVE-2013-2465

NVD Published Date: June 18, 2013 at 10:55 PM

NVD Last Modified: April 26, 2024 at 04:07 PM

Download Patch

Vulnerability ID

CVE-2013-2465

Severity

HIGH

Severity Score

10.0

Summary

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

References

http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html

https://bugzilla.redhat.com/show_bug.cgi?id=975118

http://rhn.redhat.com/errata/RHSA-2013-0963.html

http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040

http://secunia.com/advisories/54154

http://www-01.ibm.com/support/docview.wss?uid=swg21642336

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html

http://rhn.redhat.com/errata/RHSA-2013-1081.html

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html

http://rhn.redhat.com/errata/RHSA-2013-1060.html

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880

http://rhn.redhat.com/errata/RHSA-2013-1455.html

http://rhn.redhat.com/errata/RHSA-2013-1456.html

http://www.us-cert.gov/ncas/alerts/TA13-169A

http://marc.info/?l=bugtraq&m=137545592101387&w=2

http://marc.info/?l=bugtraq&m=137545505800971&w=2

http://www.mandriva.com/security/advisories?name=MDVSA-2013:183

http://rhn.redhat.com/errata/RHSA-2013-1059.html

http://advisories.mageia.org/MGASA-2013-0185.html

http://security.gentoo.org/glsa/glsa-201406-32.xml

http://www.securityfocus.com/bid/60657

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19703

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19455

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19074

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17106

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html

https://access.redhat.com/errata/RHSA-2014:0414

Mitigation and Patches

http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040

Exploits

https://www.exploit-db.com/exploits/27705

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_storeimagearray.rb

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Metasploit Payload

https://packetstormsecurity.com/files/122777

http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_storeimagearray.rb

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

CWE ID

NVD-CWE-noinfo

Recent Publish

CVE-2014-0496

CVE-2014-8439

CVE-2014-9163

CVE-2015-0310

CVE-2015-1635

CVE-2010-5326

See SecOps Solution
in action

Schedule Demo

Agentless security for your infrastructure and applications - to build faster, more securely and in a fraction of the operational cost of other solutions