Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/
http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f
http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html
http://rhn.redhat.com/errata/RHSA-2013-0752.html
http://rhn.redhat.com/errata/RHSA-2013-0757.html
http://security.gentoo.org/glsa/glsa-201406-32.xml
http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0
http://www.exploit-db.com/exploits/24976
http://www.mandriva.com/security/advisories?name=MDVSA-2013:161
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
http://www.ubuntu.com/usn/USN-1806-1
http://www.us-cert.gov/ncas/alerts/TA13-107A
https://bugzilla.redhat.com/show_bug.cgi?id=952398
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16700
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130
Source: MITRE
Published: 2013-04-17
Updated: 2017-09-19
Type: NVD-CWE-noinfo
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
OR
cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:*:update17:*:*:*:*:*:* versions up to 1.7.0 (inclusive)
cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*
OR
cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update13:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update15:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:*:update17:*:*:*:*:*:* versions up to 1.7.0 (inclusive)
cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*
ID | Name | Product | Family | Severity |
---|---|---|---|---|
76303 | GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT) | Nessus | Gentoo Local Security Checks | critical |
74999 | openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0964-1) | Nessus | SuSE Local Security Checks | critical |
74990 | openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0745-1) | Nessus | SuSE Local Security Checks | critical |
72139 | GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT) | Nessus | Gentoo Local Security Checks | critical |
71861 | IBM Domino 9.x < 9.0.1 Multiple Vulnerabilities (credentialed check) | Nessus | Windows | critical |
71859 | IBM Domino 9.x < 9.0.1 Multiple Vulnerabilities (uncredentialed check) | Nessus | Misc. | critical |
70744 | IBM Notes 8.5.x < 8.5.3 FP5 Multiple Vulnerabilities | Nessus | Windows | critical |
70743 | IBM Domino 8.5.x < 8.5.3 FP5 Multiple Vulnerabilities | Nessus | Windows | critical |
70742 | IBM Domino 8.5.x < 8.5.3 FP 5 Multiple Vulnerabilities | Nessus | Misc. | critical |
69742 | Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2013-183) | Nessus | Amazon Linux Local Security Checks | critical |
68812 | Oracle Linux 5 : java-1.7.0-openjdk (ELSA-2013-0752) | Nessus | Oracle Linux Local Security Checks | critical |
68811 | Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2013-0751) | Nessus | Oracle Linux Local Security Checks | critical |
66439 | RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2013:0822) | Nessus | Red Hat Local Security Checks | critical |
66330 | Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2013:161) | Nessus | Mandriva Local Security Checks | critical |
66200 | Ubuntu 12.10 : openjdk-7 vulnerabilities (USN-1806-1) | Nessus | Ubuntu Local Security Checks | critical |
66029 | RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2013:0757) | Nessus | Red Hat Local Security Checks | critical |
66027 | CentOS 6 : java-1.7.0-openjdk (CESA-2013:0751) | Nessus | CentOS Local Security Checks | critical |
66019 | Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20130417) | Nessus | Scientific Linux Local Security Checks | critical |
66018 | Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x i386/x86_64 (20130417) | Nessus | Scientific Linux Local Security Checks | critical |
66014 | RHEL 5 : java-1.7.0-openjdk (RHSA-2013:0752) | Nessus | Red Hat Local Security Checks | critical |
66013 | RHEL 6 : java-1.7.0-openjdk (RHSA-2013:0751) | Nessus | Red Hat Local Security Checks | critical |
66002 | CentOS 5 : java-1.7.0-openjdk (CESA-2013:0752) | Nessus | CentOS Local Security Checks | critical |
6761 | Oracle Java JDK / JRE / SE Multiple Vulnerabilities (April 2013 CPU) | Nessus Network Monitor | Web Clients | critical |
65996 | Oracle Java SE Multiple Vulnerabilities (April 2013 CPU) (Unix) | Nessus | Misc. | critical |
65995 | Oracle Java SE Multiple Vulnerabilities (April 2013 CPU) | Nessus | Windows | critical |