Unscored severity · published Mar 5, 2013
CVE-2013-1493
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote…
–
CVSS
86.2%
EPSS
No
On KEV
Description
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
Exploitation
Is it being used?
Exploit prediction (EPSS)86.2% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JD
Jdk · Oracle
through 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; +27 more · source: NVD
JR
Jre · Oracle
through 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; +27 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1493
blog.fireeye.com
http://blog.fireeye.com/research/2013/02/yaj0-yet-another-java-zero-day-2.html
h20565.www2.hp.com
http://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04117626-1
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00009.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00011.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00012.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html
More from Jdk
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
9.8
CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
9.8
CVE-2013-0422
Oracle JRE Remote Code Execution Vulnerability
9.8
CVE-2012-4681
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
9.8
CVE-2012-1723
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability