Ubuntu.comUB:CVE-2013-2459CVE-2013-2459
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.107 Low
EPSS
Percentile
95.1%
Unspecified vulnerability in the Java Runtime Environment (JRE) component
in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0
Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect
confidentiality, integrity, and availability via vectors related to AWT.
NOTE: the previous information is from the June 2013 CPU. Oracle has not
commented on claims from another vendor that this issue allows remote
attackers to bypass the Java sandbox via vectors related to “integer
overflow checks.”
Notes
| Author | Note |
|---|---|
| mdeslaur | in lucid+, NetX and the plugin moved to the icedtea-web package |
| jdstrand | sun-java6 is not redistributable, no longer in the archive and no longer tracked sun-java5 is EOL upstream and no longer tracked as of 2013-06-19, upstream IcedTea updates are not available updates break the icedtea-web plugin and it will need this fix: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-June/023745.html |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 10.04 | noarch | openjdk-6 | < 6b27-1.12.6-1ubuntu0.10.04.1 | UNKNOWN |
| ubuntu | 12.04 | noarch | openjdk-6 | < 6b27-1.12.6-1ubuntu0.12.04.1 | UNKNOWN |
| ubuntu | 12.10 | noarch | openjdk-6 | < 6b27-1.12.6-1ubuntu0.12.10.2 | UNKNOWN |
| ubuntu | 13.04 | noarch | openjdk-6 | < 6b27-1.12.6-1ubuntu0.13.04.2 | UNKNOWN |
| ubuntu | 12.04 | noarch | openjdk-7 | < 7u25-2.3.10-1ubuntu0.12.04.2 | UNKNOWN |
| ubuntu | 12.10 | noarch | openjdk-7 | < 7u25-2.3.10-1ubuntu0.12.10.2 | UNKNOWN |
| ubuntu | 13.04 | noarch | openjdk-7 | < 7u25-2.3.10-1ubuntu0.13.04.2 | UNKNOWN |
References
blog.fuseyism.com/index.php/2013/06/19/imminent-icedtea-web-breakage/
www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
launchpad.net/bugs/cve/CVE-2013-2459
nvd.nist.gov/vuln/detail/CVE-2013-2459
security-tracker.debian.org/tracker/CVE-2013-2459
ubuntu.com/security/notices/USN-1907-1
ubuntu.com/security/notices/USN-1908-1
www.cve.org/CVERecord?id=CVE-2013-2459
Related
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.107 Low
EPSS
Percentile
95.1%