CVE-2013-2421

Published: Apr 17, 2013Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect MethodHandle lookups, which allows remote attackers to bypass Java sandbox restrictions.

Affected (28)

Products: Oracle: Jre, Jdk

2 products

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Oracle Jre	Up to 1.7.0
Oracle Jre	Version 1.7.0
Oracle Jre	Version 1.7.0 update10
Oracle Jre	Version 1.7.0 update11
Oracle Jre	Version 1.7.0 update13
Oracle Jre	Version 1.7.0 update15
Oracle Jre	Version 1.7.0 update1
Oracle Jre	Version 1.7.0 update2
Oracle Jre	Version 1.7.0 update3
Oracle Jre	Version 1.7.0 update4
Oracle Jre	Version 1.7.0 update5
Oracle Jre	Version 1.7.0 update6
Oracle Jre	Version 1.7.0 update7
Oracle Jre	Version 1.7.0 update9

Configuration B

14 vulnerable

Vulnerable Software	Affected Versions
Oracle Jdk	Up to 1.7.0
Oracle Jdk	Version 1.7.0
Oracle Jdk	Version 1.7.0 update10
Oracle Jdk	Version 1.7.0 update11
Oracle Jdk	Version 1.7.0 update13
Oracle Jdk	Version 1.7.0 update15
Oracle Jdk	Version 1.7.0 update1
Oracle Jdk	Version 1.7.0 update2
Oracle Jdk	Version 1.7.0 update3
Oracle Jdk	Version 1.7.0 update4
Oracle Jdk	Version 1.7.0 update5
Oracle Jdk	Version 1.7.0 update6
Oracle Jdk	Version 1.7.0 update7
Oracle Jdk	Version 1.7.0 update9

References (38)

http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/

Source: secalert_us@oracle.com

http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/

Source: secalert_us@oracle.com

http://hg.openjdk.java.net/jdk7u/jdk7u-dev/hotspot/rev/663b5c744e82

Source: secalert_us@oracle.com

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html

Source: secalert_us@oracle.com

http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html

Source: secalert_us@oracle.com

http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html

Source: secalert_us@oracle.com

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html

Source: secalert_us@oracle.com

http://rhn.redhat.com/errata/RHSA-2013-0752.html

Source: secalert_us@oracle.com

http://rhn.redhat.com/errata/RHSA-2013-0757.html

Source: secalert_us@oracle.com

http://security.gentoo.org/glsa/glsa-201406-32.xml

Source: secalert_us@oracle.com

http://www.mandriva.com/security/advisories?name=MDVSA-2013:145

Source: secalert_us@oracle.com

http://www.mandriva.com/security/advisories?name=MDVSA-2013:161

Source: secalert_us@oracle.com

http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html

Source: secalert_us@oracle.com

Vendor Advisory

http://www.ubuntu.com/usn/USN-1806-1

Source: secalert_us@oracle.com

http://www.us-cert.gov/ncas/alerts/TA13-107A

Source: secalert_us@oracle.com

US Government Resource

https://bugzilla.redhat.com/show_bug.cgi?id=952649

Source: secalert_us@oracle.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16258

Source: secalert_us@oracle.com

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124

Source: secalert_us@oracle.com

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130

Source: secalert_us@oracle.com

http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/

Source: af854a3a-2127-422b-91ae-364da2661108

http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/

Source: af854a3a-2127-422b-91ae-364da2661108

http://hg.openjdk.java.net/jdk7u/jdk7u-dev/hotspot/rev/663b5c744e82

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0752.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0757.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-201406-32.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2013:145

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2013:161

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.ubuntu.com/usn/USN-1806-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/ncas/alerts/TA13-107A

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

https://bugzilla.redhat.com/show_bug.cgi?id=952649

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16258

Source: af854a3a-2127-422b-91ae-364da2661108

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124

Source: af854a3a-2127-422b-91ae-364da2661108

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.