Skip to content
OpenAdvisories
Unscored Public exploit CVE-2013-2472 EUVD-2013-2418GHSA-gjv2-jp2h-jxjh

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlie…

Published Jun 18, 2013 · Updated Aug 6, 2024 · Assigned by oracle

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ShortBandedRaster size checks" in 2D.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 7 openjdk-6 6b27-1.12.6-1~deb7u1 DSA-2727-1
Debian 7 openjdk-7 7u25-2.3.10-1~deb7u1 DSA-2722-1
Debian 6.0 openjdk-6 6b27-1.12.6-1~deb6u1 DSA-2727-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 java-1.5.0-ibm +6 1:1.5.0.16.3-1jpp.1.el6_4 RHSA-2013:1081
RHEL 6 java-1.6.0-ibm +6 1:1.6.0.14.0-1jpp.1.el6_4 RHSA-2013:1059
RHEL 6 java-1.6.0-openjdk +4 1:1.6.0.0-1.62.1.11.11.90.el6_4 RHSA-2013:1014
RHEL 6 java-1.7.0-ibm +5 1:1.7.0.5.0-1jpp.2.el6_4 RHSA-2013:1060
RHEL 6 java-1.7.0-openjdk +4 1:1.7.0.25-2.3.10.3.el6_4 RHSA-2013:0957
RHEL 6 java-1.7.0-oracle +5 1:1.7.0.25-1jpp.1.el6_4 RHSA-2013:0963
RHEL 5 java-1.5.0-ibm +7 1:1.5.0.16.3-1jpp.1.el5_9 RHSA-2013:1081
RHEL 5 java-1.6.0-ibm +7 1:1.6.0.14.0-1jpp.1.el5_9 RHSA-2013:1059
RHEL 5 java-1.6.0-openjdk +4 1:1.6.0.0-1.41.1.11.11.90.el5_9 RHSA-2013:1014
RHEL 5 java-1.7.0-ibm +5 1:1.7.0.5.0-1jpp.2.el5_9 RHSA-2013:1060
RHEL 5 java-1.7.0-openjdk +4 1:1.7.0.25-2.3.10.4.el5_9 RHSA-2013:0958
RHEL 5 java-1.7.0-oracle +5 1:1.7.0.25-1jpp.1.el5_9 RHSA-2013:0963
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Extras Oracle Java 6 java-1.6.0-sun +5 1:1.6.0.75-1jpp.1.el6_5 RHSA-2014:0414
Red Hat Rhel Extras Oracle Java 5 java-1.6.0-sun +5 1:1.6.0.75-1jpp.3.el5_10 RHSA-2014:0414
Red Hat Network Satellite 5 java-1.6.0-ibm +1 1:1.6.0.14.0-1jpp.1.el5_9 RHSA-2013:1456, RHSA-2013:1455

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-1_7_0-openjdk 1.7.0.121-1.1 openSUSE-SU-2024:10534-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 13

References