Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2443 and CVE-2013-2455. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "network address handling in virtual machine identifiers" and the lack of "unique and unpredictable IDs" in the java.rmi.dgc.VMID class.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | openjdk-6 | 6b27-1.12.6-1~deb7u1 | DSA-2727-1 |
| Debian 7 | openjdk-7 | 7u25-2.3.10-1~deb7u1 | DSA-2722-1 |
| Debian 6.0 | openjdk-6 | 6b27-1.12.6-1~deb6u1 | DSA-2727-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.16.3-1jpp.1.el6_4 | RHSA-2013:1081 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.14.0-1jpp.1.el6_4 | RHSA-2013:1059 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.62.1.11.11.90.el6_4 | RHSA-2013:1014 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.5.0-1jpp.2.el6_4 | RHSA-2013:1060 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.25-2.3.10.3.el6_4 | RHSA-2013:0957 |
| RHEL 6 | java-1.7.0-oracle +5 | 1:1.7.0.25-1jpp.1.el6_4 | RHSA-2013:0963 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.16.3-1jpp.1.el5_9 | RHSA-2013:1081 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.14.0-1jpp.1.el5_9 | RHSA-2013:1059 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.41.1.11.11.90.el5_9 | RHSA-2013:1014 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.5.0-1jpp.2.el5_9 | RHSA-2013:1060 |
| RHEL 5 | java-1.7.0-openjdk +4 | 1:1.7.0.25-2.3.10.4.el5_9 | RHSA-2013:0958 |
| RHEL 5 | java-1.7.0-oracle +5 | 1:1.7.0.25-1jpp.1.el5_9 | RHSA-2013:0963 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.1.el6_5 | RHSA-2014:0414 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.3.el5_10 | RHSA-2014:0414 |
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.14.0-1jpp.1.el5_9 | RHSA-2013:1456, RHSA-2013:1455 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Advisories 13
- RHSA-2013:1455 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0414 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1456 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1081 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1060 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1059 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1014 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0963 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0957 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0958 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2727-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2722-1 openjdk-7 - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2013:1060 vendor-advisory
- HPSBUX02908 vendor-advisory
- RHSA-2014:0414 vendor-advisory
- GLSA-201406-32 vendor-advisory
- 60617 vdb-entry
- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
- SUSE-SU-2013:1264 vendor-advisory
- oval:org.mitre.oval:def:16580 vdb-entry signature
- SUSE-SU-2013:1257 vendor-advisory
- HPSBUX02907 vendor-advisory
- 54154 third-party-advisory
- RHSA-2013:1455 vendor-advisory
- SSRT101305 vendor-advisory
- oval:org.mitre.oval:def:19231 vdb-entry signature
- oval:org.mitre.oval:def:19213 vdb-entry signature
- SUSE-SU-2013:1263 vendor-advisory
- RHSA-2013:1059 vendor-advisory
- SUSE-SU-2013:1293 vendor-advisory
- RHSA-2013:1081 vendor-advisory
- TA13-169A third-party-advisory
- http://advisories.mageia.org/MGASA-2013-0185.html
- http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/25ebac17c3cb
- RHSA-2013:0963 vendor-advisory
- SUSE-SU-2013:1255 vendor-advisory
- RHSA-2013:1456 vendor-advisory
- oval:org.mitre.oval:def:19665 vdb-entry signature
- MDVSA-2013:183 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21642336
- SUSE-SU-2013:1305 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=975138