Skip to content
OpenAdvisories
Unscored Public exploit CVE-2013-2419 EUVD-2013-2365GHSA-f4px-hx4m-mgqh

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlie…

Published Apr 17, 2013 · Updated Aug 6, 2024 · Assigned by oracle

Package: icu Ecosystem: Debian

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font processing errors" in the International Components for Unicode (ICU) Layout Engine before 51.2.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 icu 52.1-1 —
Debian 13 icu 52.1-1 —
Debian 12 icu 52.1-1 —
Debian 7 icu 4.8.1.1-12+deb7u2 DSA-3187-1
Debian 6.0 icu 4.4.1-8+squeeze3 DLA-219-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS icu 52.1-3ubuntu0.2 USN-2522-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 java-1.5.0-ibm +6 1:1.5.0.16.2-1jpp.1.el6_4 RHSA-2013:0855
RHEL 6 java-1.6.0-ibm +6 1:1.6.0.13.2-1jpp.1.el6_4 RHSA-2013:0823
RHEL 6 java-1.6.0-openjdk +4 1:1.6.0.0-1.61.1.11.11.el6_4 RHSA-2013:0770
RHEL 6 java-1.6.0-sun +5 1:1.6.0.45-1jpp.1.el6 RHSA-2013:0758
RHEL 6 java-1.7.0-ibm +5 1:1.7.0.4.2-1jpp.1.el6_4 RHSA-2013:0822
RHEL 6 java-1.7.0-openjdk +4 1:1.7.0.19-2.3.9.1.el6_4 RHSA-2013:0751
RHEL 6 java-1.7.0-oracle +5 1:1.7.0.21-1jpp.1.el6 RHSA-2013:0757
RHEL 5 java-1.5.0-ibm +7 1:1.5.0.16.2-1jpp.1.el5_9 RHSA-2013:0855
RHEL 5 java-1.6.0-ibm +7 1:1.6.0.13.2-1jpp.1.el5_9 RHSA-2013:0823
RHEL 5 java-1.6.0-openjdk +4 1:1.6.0.0-1.40.1.11.11.el5_9 RHSA-2013:0770
RHEL 5 java-1.6.0-sun +5 1:1.6.0.45-1jpp.1.el5_9 RHSA-2013:0758
RHEL 5 java-1.7.0-ibm +5 1:1.7.0.4.2-1jpp.1.el5_9 RHSA-2013:0822
RHEL 5 java-1.7.0-openjdk +4 1:1.7.0.19-2.3.9.1.el5_9 RHSA-2013:0752
RHEL 5 java-1.7.0-oracle +5 1:1.7.0.21-1jpp.1.el5 RHSA-2013:0757
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Network Satellite 5 java-1.6.0-ibm +1 1:1.6.0.14.0-1jpp.1.el5_9 RHSA-2013:1456, RHSA-2013:1455

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-1_7_0-openjdk 1.7.0.121-1.1 openSUSE-SU-2024:10534-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 14

References