Oracle · Java Runtime Environment (JRE)
CVE-2013-0431
Oracle JRE Sandbox Bypass Vulnerability
What it is
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
CISA: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 15, 2022
- Added to the CISA list
- May 25, 2022
- Published
- January 31, 2013
- Severity
- Low 3.7 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 90% in the top 0.2% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (20)
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:095
- http://rhn.redhat.com/errata/RHSA-2013-0237.html
- http://marc.info/?l=bugtraq&m=136439120408139&w=2
- http://rhn.redhat.com/errata/RHSA-2013-0247.html
- http://marc.info/?l=bugtraq&m=136733161405818&w=2
- http://marc.info/?l=bugtraq&m=136439120408139&w=2
- http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html
- http://marc.info/?l=bugtraq&m=136733161405818&w=2
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418
- http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/2401467…
- http://www.us-cert.gov/cas/techalerts/TA13-032A.html
- http://seclists.org/fulldisclosure/2013/Jan/142
- http://www.kb.cert.org/vuls/id/858729
- http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/
- http://seclists.org/fulldisclosure/2013/Jan/195
- http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-nu…
- http://www.securityfocus.com/archive/1/525387/30/0/threaded
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579
- http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
More exploited flaws from Oracle
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 25, 2022 | JRE Unspecified | Java Runtime Environment (JRE) | Critical 9.8 | 96% |
| May 25, 2022 | JRE Remote Code Execution | Java Runtime Environment (JRE) | Critical 9.8 | 97% |
| May 25, 2022 | JRE Unspecified | Java Runtime Environment (JRE) | Low 3.7 | 85% |
| Aug 24, 2026 | Improper Access Control | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Critical 10.0 | 73% |
| Jul 15, 2026 | Improper Privilege Management | E-Business Suite | Critical 9.8 | 12% |
| Jun 12, 2026 | PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function | PeopleSoft Enterprise PeopleTools | Critical 9.8 | 97% |
| Jun 1, 2026 | Unspecified | WebLogic Server | High 7.5 | 74% |
| Nov 21, 2025 | Missing Authentication for Critical Function | Fusion Middleware | Critical 9.8 | 89% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.