Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect invocation of the defaultReadObject method in the ConcurrentHashMap class, which allows remote attackers to bypass the Java sandbox.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.61.1.11.11.el6_4 | RHSA-2013:0770 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.4.2-1jpp.1.el6_4 | RHSA-2013:0822 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.19-2.3.9.1.el6_4 | RHSA-2013:0751 |
| RHEL 6 | java-1.7.0-oracle +5 | 1:1.7.0.21-1jpp.1.el6 | RHSA-2013:0757 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.40.1.11.11.el5_9 | RHSA-2013:0770 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.4.2-1jpp.1.el5_9 | RHSA-2013:0822 |
| RHEL 5 | java-1.7.0-openjdk +4 | 1:1.7.0.19-2.3.9.1.el5_9 | RHSA-2013:0752 |
| RHEL 5 | java-1.7.0-oracle +5 | 1:1.7.0.21-1jpp.1.el5 | RHSA-2013:0757 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Advisories 6
- RHSA-2013:0822 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0770 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0757 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0752 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0751 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- GLSA-201406-32 vendor-advisory
- [distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! mailing-list
- MDVSA-2013:145 vendor-advisory
- TA13-107A third-party-advisory
- http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130
- RHSA-2013:0757 vendor-advisory
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124
- openSUSE-SU-2013:0777 vendor-advisory
- MDVSA-2013:161 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=952653
- oval:org.mitre.oval:def:16683 vdb-entry signature
- openSUSE-SU-2013:0964 vendor-advisory
- RHSA-2013:0752 vendor-advisory
- USN-1806-1 vendor-advisory
- SUSE-SU-2013:0814 vendor-advisory
- http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/98ad2f1e25d1
- http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
- http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/