Fedora 16 : java-1.7.0-openjdk-1.7.0.9-2.3.4.fc16 (2013-0888)

This update fixes rhbz895035 , which consists of a set of flaws that potentially allow arbitrary code execution including remotely via applets. It is strongly recommended that all Java users in Fedora immediately update to this release. Note that Tenable Network Security has extracted the precedi...

Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x, SL6.x i386/x86_64 (20130116)

Two improper permission check issues were discovered in the reflection API in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. CVE-2012-3174, CVE-2013-0422 This erratum also upgrades the OpenJDK package to IcedTea7 2.3.4. All running...

CentOS 5 / 6 : java-1.7.0-openjdk (CESA-2013:0165)

Updated java-1.7.0-openjdk packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Important: Red Hat Security Advisory: java-1.7.0-openjdk security update

Updated java-1.7.0-openjdk packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

OpenJDK: MethodHandles.Lookup incorrect permission checks, Java 7 0day (Libraries, 8006017)

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by 1 using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using t...

Oracle Patches Java Zero Day Vulnerability

Oracle delivered an unusual emergency patch to Java's critical Zero Day vulnerability on Sunday to fix a malicious bug that allowed hackers access to users web browsers. Exploits for the previously undisclosed flaw were being hosted in a number of exploit kits and attacks have already been seen i...

Oracle Patches Java Zero Day Vulnerability

Oracle delivered an unusual emergency patch to Java's critical Zero Day vulnerability on Sunday to fix a malicious bug that allowed hackers access to users web browsers. Exploits for the previously undisclosed flaw were being hosted in a number of exploit kits and attacks have already been seen i...

RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2013:0156)

Updated java-1.7.0-oracle packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...

Design/Logic Flaw

Unspecified vulnerability in Oracle Java 7 before Update 11 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-0422. NOTE: some parties have mapped CVE-2012-3174 to an issue involving recursive use of the...

Critical: Red Hat Security Advisory: java-1.7.0-oracle security update

Updated java-1.7.0-oracle packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...

OpenJDK: MethodHandles.Lookup incorrect permission checks, Java 7 0day (Libraries, 8006017)

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by 1 using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using t...

OpenJDK: MethodHandles incorrect permission checks (Libraries, 8004933)

Unspecified vulnerability in Oracle Java 7 before Update 11 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-0422. NOTE: some parties have mapped CVE-2012-3174 to an issue involving recursive use of the...

Emergency Zero-Day Patch Does Not Quiet Calls to Disable Java

Oracle’s emergency Java update this weekend for a zero-day sandbox bypass vulnerability hasn’t exactly kicked off a love-fest for the company among security experts. Researchers are still cautious about recommending users re-enable the ubiquitous software, despite the availability of the fix for...

Java MBeanInstantiator.findClass and Recursive Reflection Sandbox Escape

Added: 01/14/2013 CVE: CVE-2013-0422 BID: 57246 OSVDB: 89059 Background Java is a programming language that compiles programs to bytecode, which is then executed inside a Java Virtual Machine. This is optimal for applications that must run on various hardware platforms, such as web applets. Probl...

Java MBeanInstantiator.findClass and Recursive Reflection Sandbox Escape

Added: 01/14/2013 CVE: CVE-2013-0422 BID: 57246 OSVDB: 89059 Background Java is a programming language that compiles programs to bytecode, which is then executed inside a Java Virtual Machine. This is optimal for applications that must run on various hardware platforms, such as web applets. Probl...

Oracle Java 7 JmxMBeanServer类远程代码执行漏洞

BUGTRAQ ID: 57246 CVE ID: CVE-2013-0422 Oracle Java Runtime Environment JRE是一款为JAVA应用程序提供可靠运行环境的解决方案。 Oracle JRE7环境中的jmx.mbeanserver.JmxMBeanServer类存在沙盒绕过漏洞使得远程攻击者可以绕过java securityManager的检查远程执行任意java代码控制用户系统。 目前已知受影响环境为最新版本Oracle JRE7 update 10及其更早版本。经测试Oracle Java 6不受影响。 0 Oracle Java 7 Update ...

Oracle Java JmxMBeanServer Package Sandbox Breach (CVE-2013-0422)

Two vulnerabilities have been reported in Oracle Java that can be used to breach the security sandbox. The first vulnerability is due to an access control failure in the com.sun.jmx.mbeanserver package. The second vulnerability is due to an access control failure in the invokeWithArguments method...

Java Applet JMX Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class Metasploit3 false def initialize inf...

CVE-2013-0422

creationtimestamp| type| source ---|---|--- 2013-01-11 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/24045 2014-01-15 10:35:25+00:00| seen| MISP/52d6636d-b21c-468f-aa25-4b3c950d2109 2014-02-27 09:03:19+00:00| seen| MISP/530efe60-c084-4934-b3db-6e9aac1d4fa4 2018-05-29...

CVE-2013-0422

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by 1 using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using t...