CVE-2013-0402
published 2013-03-08CVE-2013-0402: Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote…
PriorityP352critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
9.63%
94.9th percentile
Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | javafx | <= 2.2.7 | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | jdk | <= 1.7.0 | — |
| oracle | jdk | — | — |
| oracle | jre | <= 1.7.0 | — |
| oracle | jre | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
vendor_redhat·2013-04-16·CVSS 10.0
CVE-2013-2428 [CRITICAL] JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than CVE-2013-0402, CVE-2013-2414, and CVE-2013-2427.
Red Hat
JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
vendor_redhat·2013-04-16·CVSS 10.0
CVE-2013-2427 [CRITICAL] JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than CVE-2013-0402, CVE-2013-2414, and CVE-2013-2428.
Red Hat
JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
vendor_redhat·2013-04-16·CVSS 10.0
CVE-2013-2414 [CRITICAL] JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than CVE-2013-0402, CVE-2013-2427, and CVE-2013-2428.
Red Hat
JDK: unspecified JavaFX buffer overflow leading to JVM compromise (CanSecWest 2013, JavaFX)
vendor_redhat·2013-03-06·CVSS 10.0
CVE-2013-0402 [CRITICAL] JDK: unspecified JavaFX buffer overflow leading to JVM compromise (CanSecWest 2013, JavaFX)
JDK: unspecified JavaFX buffer overflow leading to JVM compromise (CanSecWest 2013, JavaFX)
Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
Package: java-1.6.0-openjdk (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.7.0-openjdk (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.6.0-openjdk (Red Hat Enterprise Linux 6) - Not affected
Package: java-1.7.0-openjdk (Red Hat Enterprise Linux 6) - Not affected
GHSA
GHSA-qwqw-pj6q-q5rj: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2013-2414 [CRITICAL] GHSA-qwqw-pj6q-q5rj: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than CVE-2013-0402, CVE-2013-2427, and CVE-2013-2428.
GHSA
GHSA-jw8r-h96r-55w9: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2013-2428 [CRITICAL] GHSA-jw8r-h96r-55w9: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than CVE-2013-0402, CVE-2013-2414, and CVE-2013-2427.
GHSA
GHSA-4463-4cg8-898f: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2013-2427 [CRITICAL] GHSA-4463-4cg8-898f: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than CVE-2013-0402, CVE-2013-2414, and CVE-2013-2428.
GHSA
GHSA-8256-4rjv-442v: Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2
ghsa_unreviewed·2022-05-05
CVE-2013-0402 [HIGH] CWE-119 GHSA-8256-4rjv-442v: Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2
Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
No detection rules found.
Bugzilla
Oracle JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
bugzilla·2013-04-17·CVSS 10.0
CVE-2013-2414 [CRITICAL] Oracle JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
Oracle JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
Oracle Java SE 7 Update 21 fixes multiple unspecified vulnerabilities in the JavaFX component. Upstream has CVSSv2 scored these issue as:
CVE-2013-2414 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
CVE-2013-2428 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
CVE-2013-2427 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
CVE-2013-0402 9.3/AV:N/AC:M/Au:N/C:C/I:C/A:C
CVE-2013-1561 5.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CVE-2013-1564 5.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
CVE-2013-2438 5.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Discussion:
(In reply to comment #0)
> CVE-2013-0402 9.3/AV:N/AC:M/Au:N/C:C/I:C/A:C
This is VUPEN CanSecWest 2013 issue, see bug 920246.
---
This issue has be
Bugzilla
CVE-2013-0402 Oracle JDK: unspecified JavaFX buffer overflow leading to JVM compromise (CanSecWest 2013, JavaFX)
bugzilla·2013-03-11·CVSS 10.0
CVE-2013-0402 [CRITICAL] CVE-2013-0402 Oracle JDK: unspecified JavaFX buffer overflow leading to JVM compromise (CanSecWest 2013, JavaFX)
CVE-2013-0402 Oracle JDK: unspecified JavaFX buffer overflow leading to JVM compromise (CanSecWest 2013, JavaFX)
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-0402 to the following vulnerability:
Heap-based buffer overflow in Oracle Java 7 Update 17, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0402
[2] http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157
[3] http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/
[4] https://twitter.com/thezdi/status/309484730506698752
Discussion:
This is now fixed in Java SE 7u21 and JavaF
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157http://rhn.redhat.com/errata/RHSA-2013-0757.htmlhttp://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.htmlhttp://www.us-cert.gov/ncas/alerts/TA13-107Ahttp://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15728https://twitter.com/thezdi/status/309484730506698752http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157http://rhn.redhat.com/errata/RHSA-2013-0757.htmlhttp://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.htmlhttp://www.us-cert.gov/ncas/alerts/TA13-107Ahttp://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15728https://twitter.com/thezdi/status/309484730506698752
2013-03-08
Published