Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect IntegerComponentRaster size checks."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | openjdk-6 | 6b27-1.12.6-1~deb7u1 | DSA-2727-1 |
| Debian 7 | openjdk-7 | 7u25-2.3.10-1~deb7u1 | DSA-2722-1 |
| Debian 6.0 | openjdk-6 | 6b27-1.12.6-1~deb6u1 | DSA-2727-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.16.3-1jpp.1.el6_4 | RHSA-2013:1081 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.14.0-1jpp.1.el6_4 | RHSA-2013:1059 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.62.1.11.11.90.el6_4 | RHSA-2013:1014 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.5.0-1jpp.2.el6_4 | RHSA-2013:1060 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.25-2.3.10.3.el6_4 | RHSA-2013:0957 |
| RHEL 6 | java-1.7.0-oracle +5 | 1:1.7.0.25-1jpp.1.el6_4 | RHSA-2013:0963 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.16.3-1jpp.1.el5_9 | RHSA-2013:1081 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.14.0-1jpp.1.el5_9 | RHSA-2013:1059 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.41.1.11.11.90.el5_9 | RHSA-2013:1014 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.5.0-1jpp.2.el5_9 | RHSA-2013:1060 |
| RHEL 5 | java-1.7.0-openjdk +4 | 1:1.7.0.25-2.3.10.4.el5_9 | RHSA-2013:0958 |
| RHEL 5 | java-1.7.0-oracle +5 | 1:1.7.0.25-1jpp.1.el5_9 | RHSA-2013:0963 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.1.el6_5 | RHSA-2014:0414 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.3.el5_10 | RHSA-2014:0414 |
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.14.0-1jpp.1.el5_9 | RHSA-2013:1456, RHSA-2013:1455 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Advisories 13
- RHSA-2013:1455 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0414 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1456 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1081 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1060 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1059 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1014 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0963 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0957 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0958 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2727-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2722-1 openjdk-7 - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2013:1060 vendor-advisory
- HPSBUX02908 vendor-advisory
- RHSA-2014:0414 vendor-advisory
- GLSA-201406-32 vendor-advisory
- oval:org.mitre.oval:def:16840 vdb-entry signature
- oval:org.mitre.oval:def:19441 vdb-entry signature
- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
- SUSE-SU-2013:1264 vendor-advisory
- SUSE-SU-2013:1257 vendor-advisory
- HPSBUX02907 vendor-advisory
- oval:org.mitre.oval:def:19413 vdb-entry signature
- SUSE-SU-2013:1256 vendor-advisory
- 54154 third-party-advisory
- RHSA-2013:1455 vendor-advisory
- SSRT101305 vendor-advisory
- http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/4c3d38927a26
- oval:org.mitre.oval:def:19295 vdb-entry signature
- SUSE-SU-2013:1263 vendor-advisory
- 60659 vdb-entry
- RHSA-2013:1059 vendor-advisory
- SUSE-SU-2013:1293 vendor-advisory
- RHSA-2013:1081 vendor-advisory
- TA13-169A third-party-advisory
- http://advisories.mageia.org/MGASA-2013-0185.html
- RHSA-2013:0963 vendor-advisory
- SUSE-SU-2013:1255 vendor-advisory
- RHSA-2013:1456 vendor-advisory
- MDVSA-2013:183 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=975102
- http://www-01.ibm.com/support/docview.wss?uid=swg21642336
- SUSE-SU-2013:1305 vendor-advisory