9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.053 Low
EPSS
Percentile
92.9%
Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45,
and OpenJDK 7, allows remote attackers to affect confidentiality,
integrity, and availability via unknown vectors related to Libraries.
NOTE: the previous information is from the January 2014 CPU. Oracle has not
commented on third-party claims that the issue is related to improper
handling of methods in MethodHandles in HotSpot JVM, which allows attackers
to escape the sandbox.
Author | Note |
---|---|
mdeslaur | in lucid+, NetX and the plugin moved to the icedtea-web package |
jdstrand | sun-java6 is not redistributable, no longer in the archive and no longer tracked sun-java5 is EOL upstream and no longer tracked |
www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5893
launchpad.net/bugs/cve/CVE-2013-5893
nvd.nist.gov/vuln/detail/CVE-2013-5893
rhn.redhat.com/errata/RHSA-2014-0026.html
security-tracker.debian.org/tracker/CVE-2013-5893
ubuntu.com/security/notices/USN-2089-1