Oracle · Java Runtime Environment (JRE)
CVE-2013-2423
Oracle JRE Unspecified Vulnerability
What it is
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
CISA: Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 15, 2022
- Added to the CISA list
- May 25, 2022
- Published
- April 17, 2013
- Severity
- Low 3.7 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 85% in the top 0.3% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (16)
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://rhn.redhat.com/errata/RHSA-2013-0757.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:161
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html
- http://rhn.redhat.com/errata/RHSA-2013-0752.html
- http://www.ubuntu.com/usn/USN-1806-1
- http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0
- http://www.us-cert.gov/ncas/alerts/TA13-107A
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130
- http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f
- http://www.exploit-db.com/exploits/24976
- http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html
- https://bugzilla.redhat.com/show_bug.cgi?id=952398
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16700
- http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
- http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/
More exploited flaws from Oracle
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 25, 2022 | JRE Unspecified | Java Runtime Environment (JRE) | Critical 9.8 | 96% |
| May 25, 2022 | JRE Remote Code Execution | Java Runtime Environment (JRE) | Critical 9.8 | 97% |
| May 25, 2022 | JRE Sandbox Bypass | Java Runtime Environment (JRE) | Low 3.7 | 90% |
| Aug 24, 2026 | Improper Access Control | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Critical 10.0 | 73% |
| Jul 15, 2026 | Improper Privilege Management | E-Business Suite | Critical 9.8 | 12% |
| Jun 12, 2026 | PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function | PeopleSoft Enterprise PeopleTools | Critical 9.8 | 97% |
| Jun 1, 2026 | Unspecified | WebLogic Server | High 7.5 | 74% |
| Nov 21, 2025 | Missing Authentication for Critical Function | Fusion Middleware | Critical 9.8 | 89% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.