← Back

CVE-2013-4578

nvd nist
Published: Dec 29, 2017Modified: May 13, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.

Affected (68)

Products: Oracle: Jdk, Jre
Oracle
2 products
Jdk
Jre
Configuration A
66 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Jdk
Version 1.7.0 update10
Jdk
Version 1.7.0 update10_b31
Jdk
Version 1.7.0 update11
Jdk
Version 1.7.0 update11_b32
Jdk
Version 1.7.0 update13
Jdk
Version 1.7.0 update15
Jdk
Version 1.7.0 update17
Jdk
Version 1.7.0 update17_b31
Jdk
Version 1.7.0 update17_b32
Jdk
Version 1.7.0 update1
Jdk
Version 1.7.0 update21
Jdk
Version 1.7.0 update21_b31
Jdk
Version 1.7.0 update25
Jdk
Version 1.7.0 update25_b33
Jdk
Version 1.7.0 update25_b34
Jdk
Version 1.7.0 update25_b35
Jdk
Version 1.7.0 update2
Jdk
Version 1.7.0 update3
Jdk
Version 1.7.0 update40
Jdk
Version 1.7.0 update45
Jdk
Version 1.7.0 update45_b31
Jdk
Version 1.7.0 update45_b32
Jdk
Version 1.7.0 update45_b33
Jdk
Version 1.7.0 update45_b34
Jdk
Version 1.7.0 update4
Jdk
Version 1.7.0 update51
Jdk
Version 1.7.0 update5
Jdk
Version 1.7.0 update6
Jdk
Version 1.7.0 update7
Jdk
Version 1.7.0 update7_b32
Jdk
Version 1.7.0 update9
Jdk
Version 1.7.0 update9_b31
Jdk
Version 1.7.0 update9_b32
Oracle
Jre
Version 1.7.0 update10
Jre
Version 1.7.0 update10_b31
Jre
Version 1.7.0 update11
Jre
Version 1.7.0 update11_b32
Jre
Version 1.7.0 update13
Jre
Version 1.7.0 update15
Jre
Version 1.7.0 update17
Jre
Version 1.7.0 update17_b31
Jre
Version 1.7.0 update17_b32
Jre
Version 1.7.0 update1
Jre
Version 1.7.0 update21
Jre
Version 1.7.0 update21_b31
Jre
Version 1.7.0 update25
Jre
Version 1.7.0 update25_b33
Jre
Version 1.7.0 update25_b34
Jre
Version 1.7.0 update25_b35
Jre
Version 1.7.0 update2
Jre
Version 1.7.0 update3
Jre
Version 1.7.0 update40
Jre
Version 1.7.0 update45
Jre
Version 1.7.0 update45_b31
Jre
Version 1.7.0 update45_b32
Jre
Version 1.7.0 update45_b33
Jre
Version 1.7.0 update45_b34
Jre
Version 1.7.0 update4
Jre
Version 1.7.0 update51
Jre
Version 1.7.0 update5
Jre
Version 1.7.0 update6
Jre
Version 1.7.0 update7
Jre
Version 1.7.0 update7_b32
Jre
Version 1.7.0 update9
Jre
Version 1.7.0 update9_b31
Jre
Version 1.7.0 update9_b32
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Jdk
Up to 1.7.0
Jre
Up to 1.7.0

Related CWEs

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (10)

Source: secalert@redhat.com
PatchVendor Advisory
Source: secalert@redhat.com
Mailing ListThird Party Advisory
Source: secalert@redhat.com
Mailing ListThird Party Advisory
Source: secalert@redhat.com
PatchThird Party AdvisoryVDB Entry
Source: secalert@redhat.com
Issue TrackingPatchThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchThird Party AdvisoryVDB Entry

Timeline

No history available yet.