CVE-2013-1490

JDK: complete Java security sandbox bypass (Issue 51)

Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka "Issue 51," a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability.

CVSS 2.0 · 4.3 Medium EPSS 2.7% KEV · Not listed

Vendors

Oracle

Products

Jdk Jre

CVE-2013-1489

7: bypass of the security level setting in browser plugin (Deployment, SE-2012-01 Issue 53)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka "Issue 53" and the "Java Security Slider" vulnerability.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed

Vendors

Google Microsoft Mozilla and 3 more

Products

Chrome Internet Explorer Firefox and 4 more

CVE-2013-1488

OpenJDK: JDBC driver manager improper toString calls (CanSecWest 2013, Libraries, 8009814)

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

CVSS 2.0 · 10.0 Critical EPSS 87.2% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 1 more

CVE-2013-1487

JDK: unspecified vulnerability fixed in 6u41 and 7u15 (Deployment)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE 7 Update 13 and earlier and 6 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2013-1486

OpenJDK: MBeanServer insufficient privilege restrictions (JMX, 8006446)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 2.0 · 10.0 Critical EPSS 6.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-1485

OpenJDK: MethodHandles insufficient privilege checks (Libraries, 8006439)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0 · 5.0 Medium EPSS 4.0% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 1 more

CVE-2013-1484

OpenJDK: MethodHandleProxies insufficient privilege checks (Libraries, 8004937)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0 · 10.0 Critical EPSS 6.2% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 1 more

CVE-2013-1481

JDK: unspecified vulnerability fixed in 6u39 (Sound)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound.

CVSS 2.0 · 10.0 Critical EPSS 7.5% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2013-1480

OpenJDK: image parser insufficient raster parameter checks (AWT, 8002325)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption.

CVSS 2.0 · 10.0 Critical EPSS 7.7% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2013-5889

JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, CVE-2014-0418, and CVE-2014-0424.

CVSS 2.0 · 9.3 Critical EPSS 5.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 2 more

CVE-2013-5893

OpenJDK: JVM method processing issues (Libraries, 8029507)

Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to improper handling of methods in MethodHandles in HotSpot JVM, which allows attackers to escape the sandbox.

CVSS 2.0 · 9.3 Critical EPSS 5.3% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 1 more

CVE-2013-5895

JDK: multiple unspecified vulnerabilities fixed in 7u51 (JavaFX)

Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect confidentiality via unknown vectors related to JavaFX.

CVSS 2.0 · 5.0 Medium EPSS 5.7% KEV · Not listed

Vendors

Hp Oracle Redhat

Products

Hp-ux Jdk Jre and 9 more

CVE-2013-5896

OpenJDK: com.sun.corba.se. should be restricted package (CORBA, 8025022)

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that com.sun.corba.se and its sub-packages are not included on the restricted package list.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2013-5898

JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-0375 and CVE-2014-0403.

CVSS 2.0 · 4.0 Medium EPSS 3.5% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 2 more

CVE-2013-5899

JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

CVSS 2.0 · 5.0 Medium EPSS 3.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 2 more

CVE-2013-5902

JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2014-0410, CVE-2014-0415, CVE-2014-0418, and CVE-2014-0424.

CVSS 2.0 · 5.1 Medium EPSS 3.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras and 1 more

CVE-2013-5904

JDK: unspecified vulnerability fixed in 7u51 (Deployment)

Unspecified vulnerability in Oracle Java SE 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 6.8 Medium EPSS 4.9% KEV · Not listed

Vendors

Hp Oracle Redhat

Products

Hp-ux Jdk Jre and 8 more

CVE-2013-5905

JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (Install)

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install, a different vulnerability than CVE-2013-5906.

CVSS 2.0 · 5.1 Medium EPSS 3.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras and 1 more

CVE-2013-5906

JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (Install)

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install, a different vulnerability than CVE-2013-5905.

CVSS 2.0 · 5.1 Medium EPSS 6.3% KEV · Not listed

Vendors

Hp Oracle Redhat

Products

Hp-ux Jdk Jre and 10 more

CVE-2013-5907

ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034)

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is due to incorrect input validation in LookupProcessor.cpp in the ICU Layout Engine, which allows attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted font file.

CVSS 2.0 · 10.0 Critical EPSS 8.2% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 4 more