CVE-2013-2423Oracle JRE Unspecified Vulnerability

Beschreibung

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GLSA-201406-32 vendor-advisoryThird Party Advisory
• http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0 Broken Link
• TA13-107A third-party-advisoryThird Party AdvisoryUS Government Resource
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 Third Party Advisory
• RHSA-2013:0757 vendor-advisoryThird Party Advisory
• http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f Patch
• 24976 exploitThird Party AdvisoryVDB Entry
• MDVSA-2013:161 vendor-advisoryThird Party Advisory
• openSUSE-SU-2013:0964 vendor-advisoryThird Party Advisory
• RHSA-2013:0752 vendor-advisoryThird Party Advisory
• USN-1806-1 vendor-advisoryThird Party Advisory
• http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html Not Applicable
• https://bugzilla.redhat.com/show_bug.cgi?id=952398 Issue Tracking
• oval:org.mitre.oval:def:16700 vdb-entrysignatureBroken Link
• http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html Vendor Advisory
• http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ Broken Link
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2423 US Government Resource