Critical severity · published Jun 18, 2013
CVE-2013-2465
Oracle Java SE Unspecified Vulnerability
RansomwareIn wildKEV
9.8
CVSS
98.8%
EPSS
Yes
On KEV
Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)98.8% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 28, 2022
Federal remediation dueApr 18, 2022
Ransomware campaign useKnown
Affected products
Which versions
JR
Jre · Oracle
1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; +34 more · source: NVD
LE
Linux Enterprise Desktop · Suse
10 · source: NVD
LE
Linux Enterprise Java · Suse
10; 11; 11 · source: NVD
LE
Linux Enterprise Server · Suse
10; 10; 11; 11; 11; 11 · source: NVD
LE
Linux Enterprise Software Development Kit · Suse
11; 11 · source: NVD
JS
Java SE · Oracle
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2465
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2465
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
http://rhn.redhat.com/errata/RHSA-2013-1060.html
vendor-advisory
http://marc.info/?l=bugtraq&m=137545592101387&w=2
vendor-advisory
https://access.redhat.com/errata/RHSA-2014:0414
vendor-advisory
http://security.gentoo.org/glsa/glsa-201406-32.xml
vdb-entry
http://www.securityfocus.com/bid/60657
x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
More from Jre
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
9.8
CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
9.8
CVE-2013-0422
Oracle JRE Remote Code Execution Vulnerability
9.8
CVE-2012-5076
Oracle Java SE Sandbox Bypass Vulnerability
9.8
CVE-2012-4681
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability