PT-2013-3172 · Oracle · Java Se

Adam Gowdiak · Published 2013-01-31 · Updated 2025-03-13 · CVE-2013-1490

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 6 and 7 Update 11 (JRE 1.7.0 11-b21)

Description The issue allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors. It is noted that as of 20130130, there were no independently-verifiable details and no vendor acknowledgement. This issue also exists in Java SE 6, but it cannot be exploited without a separate vulnerability.

Recommendations For Oracle Java SE version 7 Update 11 (JRE 1.7.0 11-b21), at the moment, there is no information about a newer version that contains a fix for this issue. For Oracle Java SE version 6, consider restricting access to minimize potential exploitation risks, as it requires a separate vulnerability to be exploitable.

Fix

Related Identifiers

CVE-2013-1490

Affected Products

Java Se

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2013-1490 · Security Note
• https://t.me/cvenotify/106439 · Telegram Post
• http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53 · Note
• http://seclists.org/fulldisclosure/2013/Jan/142 · Note
• http://informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717 · Note
• http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version · Note
• http://seclists.org/fulldisclosure/2013/Jan/195 · Note
• https://t.me/cvenotify/114767 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1490 · Note
• http://securityfocus.com/archive/1/525387/30/0/threaded · Note