Design/Logic Flaw

The Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competiti...

Heap overflow

Heap-based buffer overflow in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX, as demonstrated by VUPEN during a Pwn2Own competition at...

Design/Logic Flaw

The Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own...

CVE-2013-1491

The Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own...

CVE-2013-1488

The Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James...

CVE-2013-0401

CVE-2013-0401 is listed as fixed in MiracleLinux advisories AXSA-2013-427/AXSA-2013-428 for MiracleLinux 3.x/4.x OpenJDK (java-1.6.0-openjdk). The issue is a remote code execution via vectors related to AWT in OpenJDK/JRE. Remediation is to upgrade the OpenJDK runtime as described in the AXSA adv...

CVE-2013-1491

The Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own...

CVE-2013-0401

The Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competiti...

Firefox, Java, Flash All Taken Down at Pwn2Own

VANCOUVER–Finding and exploiting new vulnerabilities in the major browsers has become a difficult exercise for security researchers, thanks to the exploit mitigations, sandboxes and other protections that Microsoft, Google and Mozilla have added in the last few years. The same has become true of...

Chaouki Bekrar

The team from French research firm VUPEN, including CEO Chaouki Bekrar, has dominated the Pwn2Own hacking contest, taking down several targets, including Internet Explorer 10, Java and Mozilla Firefox. They plan to attack Adobe Flash on Thursday...

Chrome, Firefox, Java, IE10 exploited at Pwn2Own competition

During the first day of Pwn2Own competition at the CanSecWest conference in Vancouver , latest versions of all major browsers were exploited by hackers. Chrome, Firefox and Internet Explorer 10 on Windows 8 were successfully pwned by various competitors, bringing them tens of thousands of dollars...

Chrome, Firefox, Java, IE10 exploited at Pwn2Own competition

During the first day of Pwn2Own competition at the CanSecWest conference in Vancouver , latest versions of all major browsers were exploited by hackers. Chrome, Firefox and Internet Explorer 10 on Windows 8 were successfully pwned by various competitors, bringing them tens of thousands of dollars...

At Pwn2Own, Browser Exploits Getting Harder, More Expensive to Find

VANCOUVER–The Pwn2Own contest has evolved in many ways over the years, from new rules to new targets to larger prizes, but perhaps the one thing that has changed the most is that the researchers who show up here every year hoping to go home with a bag full of money are having to spend more and mo...

Google Patches 10 Chrome Flaws Ahead of Pwn2Own, Pwnium

Google raised the degree of difficulty for Pwn2Own and Pwnium hacking contestants by patching 10 vulnerabilities in its Web browser last night. The popular contests, which kick off tomorrow in Vancouver at the CanSecWest Conference, feature millions in prize money for researchers who can crack no...

Pwn2Own, Pwnium Attract Dollars and 0-Days by the Bushel

The new year is barely two months old and it’s already been a brutal one for the disclosure of new vulnerabilities. Java, Adobe Reader, Flash, Google Chrome and a number of other widely deployed applications have all been hit with a slew of serious bugs in just the last few weeks. And that’s like...

Google Announces Pwnium 3, Ups Ante and Offers $3M+ in Rewards

Search giant Google is planning a third iteration of its vulnerability-finding contest, Pwnium. This year’s competition is set to be held alongside next month’s CanSecWest security conference on March 7 in Vancouver, BC. Unlike last year’s inaugural Pwnium, which was parallel to CanSecWest’s olde...

Pwn2Own Rules Change Again, Flash, Java Now Fair Game for Contestants

For the second year in row, the organizers of the Pwn2Own hacking contest at the CanSecWest conference have changed up the rules, this time making the browser plug-ins that have been frequent targets for attackers for years fair game for the contestants, as well. Adobe Flash, Reader and Oracle’s...

iPhone 5 and 4 Hacked with same Exploit

iPhone 5 is vulnerable to the same attack that successfully breached an iPhone 4S at the mobile Pwn2Own hacker contest held this week at the EUSecWest event in Amsterdam. As we reported that Joost Pol and Daan Keuper won the mobile Pwn2Own contest by compromising a fully patched iPhone 4S device...

Android 4.0.4 multiple Zero-Day Vulnerabilities

The Samsung Galaxy S3 can be hacked via NFC, allowing attackers to download all data from the Android smartphone, security researchers demonstrated during the Mobile Pwn2Own contest in Amsterdam. Using a pair of zero day vulnerabilities, a team of security researchers from U.K.-based MWR Labs...

Google Adds Full Flash Sandbox to Chrome 21

Attackers have spent the last few years learning the ins and outs of Adobe Flash, looking for all of its weak spots, unintended behaviors and any other oddities that will enable them to exploit it. That’s been a profitable investment for them, but browser manufacturers and Adobe have been taking...