9.8Kritik KEV Fidye yazılımında kullanılıyor

CVE-2013-2465Oracle Java SE Unspecified Vulnerability

oracle jre; sun jre; suse linux enterprise desktop; suse linux enterprise java Yayım: 2013-06-19 01:00 (13 yıl önce)

Aktif olarak istismar ediliyor — Oracle Java SE Unspecified Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 28.03.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 18.04.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-2465

Açıklama

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

Zayıflık türü (CWE): CWE-693

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
oracle	jre	1.7.0
sun	jre	1.6.0
suse	linux enterprise desktop	10
suse	linux enterprise java	10
suse	linux enterprise server	10
suse	linux enterprise software development kit	11

Kaynaklar ve yamalar

RHSA-2013:1060 vendor-advisoryThird Party Advisory
HPSBUX02908 vendor-advisoryMailing ListThird Party Advisory
RHSA-2014:0414 vendor-advisoryThird Party Advisory
GLSA-201406-32 vendor-advisoryThird Party Advisory
60657 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html Vendor Advisory
SUSE-SU-2013:1264 vendor-advisoryMailing ListThird Party Advisory
SUSE-SU-2013:1257 vendor-advisoryMailing ListThird Party Advisory
HPSBUX02907 vendor-advisoryMailing ListThird Party Advisory
SUSE-SU-2013:1256 vendor-advisoryMailing ListThird Party Advisory
54154 third-party-advisoryNot Applicable
RHSA-2013:1455 vendor-advisoryThird Party Advisory
SSRT101305 vendor-advisoryBroken Link
oval:org.mitre.oval:def:19455 vdb-entrysignatureBroken Link
oval:org.mitre.oval:def:19703 vdb-entrysignatureBroken Link
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040 Patch
oval:org.mitre.oval:def:19074 vdb-entrysignatureBroken Link
SUSE-SU-2013:1263 vendor-advisoryMailing ListThird Party Advisory
RHSA-2013:1059 vendor-advisoryThird Party Advisory
SUSE-SU-2013:1293 vendor-advisoryMailing ListThird Party Advisory
oval:org.mitre.oval:def:17106 vdb-entrysignatureBroken Link
RHSA-2013:1081 vendor-advisoryThird Party Advisory
TA13-169A third-party-advisoryThird Party AdvisoryUS Government Resource
http://advisories.mageia.org/MGASA-2013-0185.html Broken Link
RHSA-2013:0963 vendor-advisoryThird Party Advisory
SUSE-SU-2013:1255 vendor-advisoryMailing ListThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=975118 Issue Tracking
RHSA-2013:1456 vendor-advisoryThird Party Advisory
MDVSA-2013:183 vendor-advisoryNot Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 Third Party Advisory
SUSE-SU-2013:1305 vendor-advisoryMailing ListThird Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2013-2465-detect-java-vulnerability ExploitThird Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2013-2465-mitigate-java-vulnerability ExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2465 US Government Resource

CPE eşleşmeleri (NVD) (60)

cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update21:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:-:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update30:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update31:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update32:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update33:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update34:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update35:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update37:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update38:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update39:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update41:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update43:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update45:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_9:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.5.0:-:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.5.0:update36:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.5.0:update38:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.5.0:update39:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.5.0:update40:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.5.0:update41:*:*:*:*:*:*

CVSS puanı

9.8Kritik

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tüm puanlar (3)

CISA-ADP	CVSS 3.1	9.8Kritik
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Kritik
nvd	CVSS 2.0	10.0Yüksek

EPSS (30 günde istismar olasılığı)

98.77%

tüm CVE'lerin %100'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: active
Otomatikleştirilebilir: yes
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2013-03-05
Yayımlandı2013-06-19 01:00
IP-DB'ye ulaştı2026-10-24 23:33
KEV'e eklendi2022-03-28
Son güncelleme2026-06-17 02:53

Numarayı veren (CNA): oracle
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Java SE / OpenJDK

9.1Kritik

CVE-2026-114820 18 gün önce

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.…

9.1Kritik

CVE-2026-91403 21 gün önce

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1;…

4.8Orta

CVE-2026-91487 22 gün önce

Oracle Corporation Oracle Java SE

Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21…

7.5Yüksek

CVE-2026-91484 22 gün önce

Oracle Corporation Oracle Java SE

Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE …

5.9Orta

CVE-2026-91462 22 gün önce

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1,…

5.3Orta

CVE-2026-91463 22 gün önce

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition