Published: 08/03/2013 Updated: 19/09/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and previous versions, 6 Update 43 and previous versions, 5.0 Update 41 and previous versions, and JavaFX 2.2.7 and previous versions allows remote malicious users to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle jre 1.7.0
oracle jdk 1.7.0

Synopsis Critical: java-160-ibm security update Type/Severity Security Advisory: Critical Topic Updated java-160-ibm packages that fix several security issues are nowavailable for Red Hat Enterprise Linux 5 and 6 SupplementaryThe Red Hat Security Response Team has rated this update as having criticalse ...

Synopsis Low: Red Hat Network Satellite server IBM Java Runtime security update Type/Severity Security Advisory: Low Topic Updated java-160-ibm packages that fix several security issues are nowavailable for Red Hat Network Satellite Server 55The Red Hat Security Response Team has rated this update as ha ...

Synopsis Critical: java-160-sun security update Type/Severity Security Advisory: Critical Topic Updated java-160-sun packages that fix several security issues are nowavailable for Red Hat Enterprise Linux 5 and 6 SupplementaryThe Red Hat Security Response Team has rated this update as having criticalse ...

Synopsis Critical: java-170-oracle security update Type/Severity Security Advisory: Critical Topic Updated java-170-oracle packages that fix several security issues are nowavailable for Red Hat Enterprise Linux 5 and 6 SupplementaryThe Red Hat Security Response Team has rated this update as having crit ...

Synopsis Low: Red Hat Network Satellite server IBM Java Runtime security update Type/Severity Security Advisory: Low Topic Updated java-160-ibm packages that fix several security issues are nowavailable for Red Hat Network Satellite Server 54The Red Hat Security Response Team has rated this update as ha ...

JIT spray version of cve-2013-1491

========================= Title ========================================= CVE-2013-1491 PoC using JIT-Spray by Yuki Chen (古河) +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Twitter: @guhe120 Weibo: weibocom/u/1874932054 ========================= About this PoC ========================================= This exploit is a proof-of-concept

CWE-94 http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/https://twitter.com/thezdi/status/309438311112507392 http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html http://rhn.redhat.com/errata/RHSA-2013-0758.html http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00013.html http://rhn.redhat.com/errata/RHSA-2013-0757.html http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00007.html http://marc.info/?l=bugtraq&m=137283787217316&w=2 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880 http://www.us-cert.gov/ncas/alerts/TA13-107A http://rhn.redhat.com/errata/RHSA-2013-1455.html http://rhn.redhat.com/errata/RHSA-2013-1456.html http://lists.apple.com/archives/security-announce/2013/Apr/msg00001.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19553 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19482 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16663 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2013:0823 https://github.com/guhe120/CVE20131491-JIT

CVE-2013-1491

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect