CVE-2013-4578
published 2017-12-29CVE-2013-4578: jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a…
PriorityP431medium5.3CVSS 3.0
AVNACLPRNUINSUCNILAN
EPSS
2.45%
82.7th percentile
jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | jdk | <= 1.7.0 | — |
| oracle | jdk | — | — |
| oracle | jre | <= 1.7.0 | — |
| oracle | jre | — | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars
vendor_redhat·2014-01-14·CVSS 5.3
CVE-2013-4578 [MEDIUM] OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars
OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars
jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.
GHSA
GHSA-6xg2-jpwh-hh9f: jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode
ghsa_unreviewed·2022-05-14
CVE-2013-4578 [MEDIUM] CWE-74 GHSA-6xg2-jpwh-hh9f: jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode
jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.
No detection rules found.
No public exploits indexed.
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d5f36e1c927ehttp://www.openwall.com/lists/oss-security/2015/02/08/6http://www.openwall.com/lists/oss-security/2015/02/09/9https://access.redhat.com/errata/RHSA-2014:0414https://bugzilla.redhat.com/show_bug.cgi?id=1031471http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d5f36e1c927ehttp://www.openwall.com/lists/oss-security/2015/02/08/6http://www.openwall.com/lists/oss-security/2015/02/09/9https://access.redhat.com/errata/RHSA-2014:0414https://bugzilla.redhat.com/show_bug.cgi?id=1031471
2017-12-29
Published