CVE-2012-5084

OpenJDK: DefaultFormatter insufficient data validation (Swing, 7195194)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing.

CVSS 2.0 · 7.6 High EPSS 4.8% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-5089

OpenJDK: RMIConnectionImpl insufficient access control checks (JMX, 7198296)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX, a different vulnerability than CVE-2012-3143.

CVSS 2.0 · 7.6 High EPSS 4.8% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-6149

(spacewalk-java): XSS in system.addNote XML-RPC call due improper sanitization of note's subject and content

Multiple cross-site scripting (XSS) vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) content values of a note in a system.addNote XML-RPC call.

CVSS 2.0 · 3.5 Low EPSS 1.6% KEV · Not listed

Vendors

Redhat

Products

Network Satellite Satellite Satellite 5 Managed Db and 1 more

CVE-2013-0169

SSL/TLS: CBC padding timing attack (lucky-13)

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

CVSS 2.0 · 2.6 Low EPSS 35.6% KEV · Not listed

Vendors

Openssl Oracle Polarssl and 1 more

Products

Openssl Openjdk Polarssl and 8 more

CVE-2013-0351

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

CVSS 2.0 · 7.5 High EPSS 6.0% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2013-0401

OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305)

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions.

CVSS 2.0 · 10.0 Critical EPSS 10.3% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 2 more

CVE-2013-0409

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (JMX)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect confidentiality via vectors related to JMX.

CVSS 2.0 · 5.0 Medium EPSS 4.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2013-0419

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

CVSS 2.0 · 7.6 High EPSS 6.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2013-0427

OpenJDK: invalid threads subject to interrupts (Libraries, 6776941)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Libraries. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to interrupt certain threads that should not be interrupted.

CVSS 2.0 · 5.0 Medium EPSS 4.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0423

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

CVSS 2.0 · 7.6 High EPSS 6.7% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2013-0424

OpenJDK: RMI CGIHandler XSS issue (RMI, 6563318)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number.

CVSS 2.0 · 5.0 Medium EPSS 4.8% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0425

OpenJDK: logging insufficient access control checks (Libraries, 6664509)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0428 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0426

OpenJDK: logging insufficient access control checks (Libraries, 6664528)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0428. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0428

OpenJDK: reflection API incorrect checks for proxy classes (Libraries, 7197546, SE-2012-01 Issue 29)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0432

OpenJDK: insufficient clipboard access premission checks (AWT, 7186952)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks."

CVSS 2.0 · 6.4 Medium EPSS 4.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0433

OpenJDK: InetSocketAddress serialization issue (Networking, 7201071)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data.

CVSS 2.0 · 5.0 Medium EPSS 4.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0434

OpenJDK: loadPropertyFile missing restrictions (JAXP, 8001235)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information.

CVSS 2.0 · 5.0 Medium EPSS 4.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0435

OpenJDK: com.sun.xml.internal.* not restricted packages (JAX-WS, 7201068)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements."

CVSS 2.0 · 5.0 Medium EPSS 5.2% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-0438

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

CVSS 2.0 · 4.3 Medium EPSS 4.3% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2013-0440

OpenJDK: CPU consumption DoS via repeated SSL ClientHello packets (JSSE, 7192393)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java.

CVSS 2.0 · 5.0 Medium EPSS 5.5% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more