CVE-2013-1490
published 2013-01-31CVE-2013-1490: Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via…
PriorityP422medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
2.70%
84.4th percentile
Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka "Issue 51," a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | openjdk | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
JDK: complete Java security sandbox bypass (Issue 51)
vendor_redhat·2013-01-27·CVSS 5.3
CVE-2013-1490 [MEDIUM] JDK: complete Java security sandbox bypass (Issue 51)
JDK: complete Java security sandbox bypass (Issue 51)
Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka "Issue 51," a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability.
Statement: This flaw was found to be a duplic
Red Hat
OpenJDK: JMX Introspector missing package access check (JMX, 8000539, SE-2012-01 Issue 52)
vendor_redhat·2013-01-27·CVSS 5.3
CVE-2013-0431 [MEDIUM] OpenJDK: JMX Introspector missing package access check (JMX, 8000539, SE-2012-01 Issue 52)
OpenJDK: JMX Introspector missing package access check (JMX, 8000539, SE-2012-01 Issue 52)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
Package: java-1.4.2-ibm (Red Hat Enterprise Linux 5) - Will not fix
Package: java-1.5.0-ibm (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.6.0-ibm (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.6.0-openjdk (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.6.0-sun (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.5.0-ibm (Red Hat Enterprise Linux 6) -
GHSA
GHSA-hxjj-qvrq-6x75: Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1
ghsa_unreviewed·2022-05-17·CVSS 5.3
CVE-2013-1490 [MEDIUM] GHSA-hxjj-qvrq-6x75: Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1
Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka "Issue 51," a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability.
GHSA
GHSA-h3cw-j9j9-5pc4: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted r
ghsa_unreviewed·2022-05-05·CVSS 4.3
CVE-2013-0431 [MEDIUM] CWE-693 GHSA-h3cw-j9j9-5pc4: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted r
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-4348 kernel: net: deadloop path in skb_flow_dissect()
bugzilla·2013-09-13·CVSS 7.1
CVE-2013-4348 [HIGH] CVE-2013-4348 kernel: net: deadloop path in skb_flow_dissect()
CVE-2013-4348 kernel: net: deadloop path in skb_flow_dissect()
A flaw was found in the way ip packets with ihl of zero were processed in the skb_flow_dissect() function in the Linux kernel.
A remote attacker could use this flaw to cause inifinite loop in the kernel.
Acknowledgements:
This issue was found by Jason Wang of Red Hat.
Discussion:
Statement:
This issue does not affect Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6. Future Linux kernel updates for Red Hat Enterprise Linux MRG 2 might address this issue.
---
This issue has been addressed in following products:
MRG for RHEL-6 v.2
Via RHSA-2013:1490 https://rhn.redhat.com/errata/RHSA-2013-1490.html
---
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1025647]
---
http://th
Bugzilla
CVE-2013-1490 JDK: complete Java security sandbox bypass (Issue 51)
bugzilla·2013-01-31·CVSS 5.3
CVE-2013-1490 [MEDIUM] CVE-2013-1490 JDK: complete Java security sandbox bypass (Issue 51)
CVE-2013-1490 JDK: complete Java security sandbox bypass (Issue 51)
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-1490 to the following vulnerability:
Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka "Issue 51," a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also ex
Bugzilla
CVE-2013-0431 OpenJDK: JMX Introspector missing package access check (JMX, 8000539, SE-2012-01 Issue 52)
bugzilla·2013-01-31·CVSS 5.3
CVE-2013-0431 [MEDIUM] CVE-2013-0431 OpenJDK: JMX Introspector missing package access check (JMX, 8000539, SE-2012-01 Issue 52)
CVE-2013-0431 OpenJDK: JMX Introspector missing package access check (JMX, 8000539, SE-2012-01 Issue 52)
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-0431 to the following vulnerability:
Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka "Issue 52," a different vulnerability than CVE-2013-1490. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed
http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53http://seclists.org/fulldisclosure/2013/Jan/142http://seclists.org/fulldisclosure/2013/Jan/195http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717http://www.securityfocus.com/archive/1/525387/30/0/threadedhttp://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53http://seclists.org/fulldisclosure/2013/Jan/142http://seclists.org/fulldisclosure/2013/Jan/195http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717http://www.securityfocus.com/archive/1/525387/30/0/threaded
2013-01-31
Published