10

CVE-2013-1493

The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Jre Update update15 Version <= 1.7.0
Oracle ≫ Jre Version 1.7.0
Oracle ≫ Jre Version 1.7.0 Update update1
Oracle ≫ Jre Version 1.7.0 Update update10
Oracle ≫ Jre Version 1.7.0 Update update11
Oracle ≫ Jre Version 1.7.0 Update update13
Oracle ≫ Jre Version 1.7.0 Update update2
Oracle ≫ Jre Version 1.7.0 Update update3
Oracle ≫ Jre Version 1.7.0 Update update4
Oracle ≫ Jre Version 1.7.0 Update update5
Oracle ≫ Jre Version 1.7.0 Update update6
Oracle ≫ Jre Version 1.7.0 Update update7
Oracle ≫ Jre Version 1.7.0 Update update9
Oracle ≫ Jre Update update40 Version <= 1.5.0
Oracle ≫ Jre Version 1.5.0 Update update36
Oracle ≫ Jre Version 1.5.0 Update update38
Sun ≫ Jre Version 1.5.0
Sun ≫ Jre Version 1.5.0 Update update1
Sun ≫ Jre Version 1.5.0 Update update10
Sun ≫ Jre Version 1.5.0 Update update11
Sun ≫ Jre Version 1.5.0 Update update12
Sun ≫ Jre Version 1.5.0 Update update13
Sun ≫ Jre Version 1.5.0 Update update14
Sun ≫ Jre Version 1.5.0 Update update15
Sun ≫ Jre Version 1.5.0 Update update16
Sun ≫ Jre Version 1.5.0 Update update17
Sun ≫ Jre Version 1.5.0 Update update18
Sun ≫ Jre Version 1.5.0 Update update19
Sun ≫ Jre Version 1.5.0 Update update2
Sun ≫ Jre Version 1.5.0 Update update20
Sun ≫ Jre Version 1.5.0 Update update21
Sun ≫ Jre Version 1.5.0 Update update22
Sun ≫ Jre Version 1.5.0 Update update23
Sun ≫ Jre Version 1.5.0 Update update24
Sun ≫ Jre Version 1.5.0 Update update25
Sun ≫ Jre Version 1.5.0 Update update26
Sun ≫ Jre Version 1.5.0 Update update27
Sun ≫ Jre Version 1.5.0 Update update28
Sun ≫ Jre Version 1.5.0 Update update29
Sun ≫ Jre Version 1.5.0 Update update3
Sun ≫ Jre Version 1.5.0 Update update31
Sun ≫ Jre Version 1.5.0 Update update33
Sun ≫ Jre Version 1.5.0 Update update4
Sun ≫ Jre Version 1.5.0 Update update5
Sun ≫ Jre Version 1.5.0 Update update6
Sun ≫ Jre Version 1.5.0 Update update7
Sun ≫ Jre Version 1.5.0 Update update8
Sun ≫ Jre Version 1.5.0 Update update9
Oracle ≫ Jdk Update update41 Version <= 1.6.0
Oracle ≫ Jdk Version 1.6.0 Update update22
Oracle ≫ Jdk Version 1.6.0 Update update23
Oracle ≫ Jdk Version 1.6.0 Update update24
Oracle ≫ Jdk Version 1.6.0 Update update25
Oracle ≫ Jdk Version 1.6.0 Update update26
Oracle ≫ Jdk Version 1.6.0 Update update27
Oracle ≫ Jdk Version 1.6.0 Update update29
Oracle ≫ Jdk Version 1.6.0 Update update30
Oracle ≫ Jdk Version 1.6.0 Update update31
Oracle ≫ Jdk Version 1.6.0 Update update32
Oracle ≫ Jdk Version 1.6.0 Update update33
Oracle ≫ Jdk Version 1.6.0 Update update34
Oracle ≫ Jdk Version 1.6.0 Update update35
Oracle ≫ Jdk Version 1.6.0 Update update37
Oracle ≫ Jdk Version 1.6.0 Update update38
Oracle ≫ Jdk Version 1.6.0 Update update39
Sun ≫ Jdk Version 1.6.0
Sun ≫ Jdk Version 1.6.0 Update update_10
Sun ≫ Jdk Version 1.6.0 Update update_11
Sun ≫ Jdk Version 1.6.0 Update update_12
Sun ≫ Jdk Version 1.6.0 Update update_13
Sun ≫ Jdk Version 1.6.0 Update update_14
Sun ≫ Jdk Version 1.6.0 Update update_15
Sun ≫ Jdk Version 1.6.0 Update update_16
Sun ≫ Jdk Version 1.6.0 Update update_17
Sun ≫ Jdk Version 1.6.0 Update update_18
Sun ≫ Jdk Version 1.6.0 Update update_19
Sun ≫ Jdk Version 1.6.0 Update update_20
Sun ≫ Jdk Version 1.6.0 Update update_21
Sun ≫ Jdk Version 1.6.0 Update update_3
Sun ≫ Jdk Version 1.6.0 Update update_4
Sun ≫ Jdk Version 1.6.0 Update update_5
Sun ≫ Jdk Version 1.6.0 Update update_6
Sun ≫ Jdk Version 1.6.0 Update update_7
Sun ≫ Jdk Version 1.6.0 Update update1
Sun ≫ Jdk Version 1.6.0 Update update1_b06
Sun ≫ Jdk Version 1.6.0 Update update2
Oracle ≫ Jre Update update41 Version <= 1.6.0
Oracle ≫ Jre Version 1.6.0 Update update22
Oracle ≫ Jre Version 1.6.0 Update update23
Oracle ≫ Jre Version 1.6.0 Update update24
Oracle ≫ Jre Version 1.6.0 Update update25
Oracle ≫ Jre Version 1.6.0 Update update26
Oracle ≫ Jre Version 1.6.0 Update update27
Oracle ≫ Jre Version 1.6.0 Update update29
Oracle ≫ Jre Version 1.6.0 Update update30
Oracle ≫ Jre Version 1.6.0 Update update31
Oracle ≫ Jre Version 1.6.0 Update update32
Oracle ≫ Jre Version 1.6.0 Update update33
Oracle ≫ Jre Version 1.6.0 Update update34
Oracle ≫ Jre Version 1.6.0 Update update35
Oracle ≫ Jre Version 1.6.0 Update update37
Oracle ≫ Jre Version 1.6.0 Update update38
Oracle ≫ Jre Version 1.6.0 Update update39
Sun ≫ Jre Version 1.6.0
Sun ≫ Jre Version 1.6.0 Update update_1
Sun ≫ Jre Version 1.6.0 Update update_10
Sun ≫ Jre Version 1.6.0 Update update_11
Sun ≫ Jre Version 1.6.0 Update update_12
Sun ≫ Jre Version 1.6.0 Update update_13
Sun ≫ Jre Version 1.6.0 Update update_14
Sun ≫ Jre Version 1.6.0 Update update_15
Sun ≫ Jre Version 1.6.0 Update update_16
Sun ≫ Jre Version 1.6.0 Update update_17
Sun ≫ Jre Version 1.6.0 Update update_18
Sun ≫ Jre Version 1.6.0 Update update_19
Sun ≫ Jre Version 1.6.0 Update update_2
Sun ≫ Jre Version 1.6.0 Update update_20
Sun ≫ Jre Version 1.6.0 Update update_21
Sun ≫ Jre Version 1.6.0 Update update_3
Sun ≫ Jre Version 1.6.0 Update update_4
Sun ≫ Jre Version 1.6.0 Update update_5
Sun ≫ Jre Version 1.6.0 Update update_6
Sun ≫ Jre Version 1.6.0 Update update_7
Sun ≫ Jre Version 1.6.0 Update update_9
Oracle ≫ Jdk Update update40 Version <= 1.5.0
Oracle ≫ Jdk Version 1.5.0 Update update36
Oracle ≫ Jdk Version 1.5.0 Update update38
Sun ≫ Jdk Version 1.5.0
Sun ≫ Jdk Version 1.5.0 Update update1
Sun ≫ Jdk Version 1.5.0 Update update10
Sun ≫ Jdk Version 1.5.0 Update update11
Sun ≫ Jdk Version 1.5.0 Update update11_b03
Sun ≫ Jdk Version 1.5.0 Update update12
Sun ≫ Jdk Version 1.5.0 Update update13
Sun ≫ Jdk Version 1.5.0 Update update14
Sun ≫ Jdk Version 1.5.0 Update update15
Sun ≫ Jdk Version 1.5.0 Update update16
Sun ≫ Jdk Version 1.5.0 Update update17
Sun ≫ Jdk Version 1.5.0 Update update18
Sun ≫ Jdk Version 1.5.0 Update update19
Sun ≫ Jdk Version 1.5.0 Update update2
Sun ≫ Jdk Version 1.5.0 Update update20
Sun ≫ Jdk Version 1.5.0 Update update21
Sun ≫ Jdk Version 1.5.0 Update update22
Sun ≫ Jdk Version 1.5.0 Update update23
Sun ≫ Jdk Version 1.5.0 Update update24
Sun ≫ Jdk Version 1.5.0 Update update25
Sun ≫ Jdk Version 1.5.0 Update update26
Sun ≫ Jdk Version 1.5.0 Update update27
Sun ≫ Jdk Version 1.5.0 Update update28
Sun ≫ Jdk Version 1.5.0 Update update29
Sun ≫ Jdk Version 1.5.0 Update update3
Sun ≫ Jdk Version 1.5.0 Update update31
Sun ≫ Jdk Version 1.5.0 Update update33
Sun ≫ Jdk Version 1.5.0 Update update4
Sun ≫ Jdk Version 1.5.0 Update update5
Sun ≫ Jdk Version 1.5.0 Update update6
Sun ≫ Jdk Version 1.5.0 Update update7
Sun ≫ Jdk Version 1.5.0 Update update7_b03
Sun ≫ Jdk Version 1.5.0 Update update8
Sun ≫ Jdk Version 1.5.0 Update update9
Oracle ≫ Jdk Update update15 Version <= 1.7.0
Oracle ≫ Jdk Version 1.7.0
Oracle ≫ Jdk Version 1.7.0 Update update1
Oracle ≫ Jdk Version 1.7.0 Update update10
Oracle ≫ Jdk Version 1.7.0 Update update11
Oracle ≫ Jdk Version 1.7.0 Update update13
Oracle ≫ Jdk Version 1.7.0 Update update2
Oracle ≫ Jdk Version 1.7.0 Update update3
Oracle ≫ Jdk Version 1.7.0 Update update4
Oracle ≫ Jdk Version 1.7.0 Update update5
Oracle ≫ Jdk Version 1.7.0 Update update6
Oracle ≫ Jdk Version 1.7.0 Update update7
Oracle ≫ Jdk Version 1.7.0 Update update9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 86.15% 0.997
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://security.gentoo.org/glsa/glsa-201406-32.xml
http://rhn.redhat.com/errata/RHSA-2013-1455.html
http://rhn.redhat.com/errata/RHSA-2013-1456.html
http://www.mandriva.com/security/advisories?name=MDVSA-2013:095
http://marc.info/?l=bugtraq&m=136439120408139&w=2
http://marc.info/?l=bugtraq&m=136570436423916&w=2
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00012.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-March/022145.html
http://rhn.redhat.com/errata/RHSA-2013-0601.html
http://rhn.redhat.com/errata/RHSA-2013-0603.html
http://rhn.redhat.com/errata/RHSA-2013-0604.html
http://www.kb.cert.org/vuls/id/688246
US Government Resource
http://www.oracle.com/ocom/groups/public/%40otn/documents/webcontent/1915099.xml
http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html
http://www.ubuntu.com/usn/USN-1755-2
http://www.us-cert.gov/ncas/alerts/TA13-064A
US Government Resource
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0088
http://blog.fireeye.com/research/2013/02/yaj0-yet-another-java-zero-day-2.html
http://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04117626-1
http://www.exploit-db.com/exploits/24904
http://www.securityfocus.com/bid/58238
http://www.securitytracker.com/id/1029803
http://www.symantec.com/connect/blogs/latest-java-zero-day-shares-connections-bit9-security-incident
https://bugzilla.redhat.com/show_bug.cgi?id=917553
https://krebsonsecurity.com/2013/03/new-java-0-day-attack-echoes-bit9-breach/
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19246
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19477
https://twitter.com/jduck1337/status/307629902574800897