Oracle · Java SE
CVE-2013-2465
Oracle Java SE Unspecified Vulnerability
Cos'è
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
CISA: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 18 aprile 2022
- Aggiunta all'elenco CISA
- 28 marzo 2022
- Pubblicato
- 18 giugno 2013
- Gravità
- Critica 9,8 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 99% tra il 0,1% più alto di tutte le vulnerabilità note
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (20)
- http://rhn.redhat.com/errata/RHSA-2013-1060.html
- http://marc.info/?l=bugtraq&m=137545592101387&w=2
- https://access.redhat.com/errata/RHSA-2014:0414
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
- http://marc.info/?l=bugtraq&m=137545505800971&w=2
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html
- http://rhn.redhat.com/errata/RHSA-2013-1455.html
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html
- http://rhn.redhat.com/errata/RHSA-2013-1059.html
- http://www.securityfocus.com/bid/60657
- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
- http://secunia.com/advisories/54154
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19455
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19703
- http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19074
Altre falle sfruttate di Oracle
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 28 mar 2022 | Sandbox Bypass | Java SE | Critica 9,8 | 91% |
| 3 mar 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Critica 9,8 | 98% |
| 3 mar 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Critica 9,8 | 94% |
| 3 mar 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Critica 9,8 | 99% |
| 3 mar 2022 | and Java SE Embedded Remote Code Execution | Java SE | Critica 9,8 | 25% |
| 3 mar 2022 | Integrity Check | Java SE | Media 5,3 | 14% |
| 24 ago 2026 | Improper Access Control | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Critica 10,0 | 73% |
| 15 lug 2026 | Improper Privilege Management | E-Business Suite | Critica 9,8 | 12% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.