CVE-2013-0428

OpenJDK: reflection API incorrect checks for proxy classes (Libraries, 7197546, SE-2012-01 Issue 29)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0429

OpenJDK: PresentationManager incorrectly shared (CORBA, 7141694)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue involves the creation of a single PresentationManager that is shared across multiple thread groups, which allows remote attackers to bypass Java sandbox restrictions.

CVSS 2.0 · 7.6 High EPSS 6.7% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2013-0430

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Install)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the installation process of the client.

CVSS 2.0 · 6.9 Medium EPSS 1.2% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Rhel Extras and 2 more

CVE-2010-2206

acroread: multiple code execution flaws (APSB10-15)

Array index error in AcroForm.api in Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted GIF image in a PDF file, which bypasses a size check and triggers a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 7.0% KEV · Not listed

Vendors

Adobe Apple Microsoft and 1 more

Products

Acrobat Acrobat Reader Mac Os X and 2 more

CVE-2013-0432

OpenJDK: insufficient clipboard access premission checks (AWT, 7186952)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks."

CVSS 2.0 · 6.4 Medium EPSS 4.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0433

OpenJDK: InetSocketAddress serialization issue (Networking, 7201071)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data.

CVSS 2.0 · 5.0 Medium EPSS 4.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0434

OpenJDK: loadPropertyFile missing restrictions (JAXP, 8001235)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information.

CVSS 2.0 · 5.0 Medium EPSS 4.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0435

OpenJDK: com.sun.xml.internal.* not restricted packages (JAX-WS, 7201068)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements."

CVSS 2.0 · 5.0 Medium EPSS 5.2% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0437

JDK: unspecified vulnerability fixed in 7u13 (2D)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 5.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Javafx Jdk Jre and 1 more

CVE-2013-0438

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

CVSS 2.0 · 4.3 Medium EPSS 4.3% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2013-0440

OpenJDK: CPU consumption DoS via repeated SSL ClientHello packets (JSSE, 7192393)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java.

CVSS 2.0 · 5.0 Medium EPSS 5.5% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0441

OpenJDK: missing serialization restriction (CORBA, 7201066)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-1476 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via certain methods that should not be serialized, aka "missing serialization restriction."

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0442

OpenJDK: insufficient privilege checking issue (AWT, 7192977)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0443

OpenJDK: insufficient Diffie-Hellman public key checks (JSSE, 7192392)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0444

OpenJDK: MethodFinder insufficient checks for cached results (Beans, 7200493)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient checks for cached results" by the Java Beans MethodFinder, which might allow attackers to access methods that should only be accessible to privileged code.

CVSS 2.0 · 7.6 High EPSS 6.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 1 more

CVE-2013-0445

OpenJDK: insufficient privilege checking issue (AWT, 8001057)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0446

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2013-0448

JDK: unspecified vulnerability fixed in 7u13 (Libraries)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras

CVE-2013-0449

JDK: unspecified vulnerability fixed in 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras

CVE-2013-0450

OpenJDK: RequiredModelMBean missing access control context checks (JMX, 8000537)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more