CVE-2013-0401
NoneCVSS
—
EPSS
10.3%
Published
Mar 8, 2013
CISA due date
—
The record
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.40.1.11.11.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.40.1.11.11.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.40.1.11.11.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.40.1.11.11.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.40.1.11.11.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.40.1.11.11.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk | 0 | 1:1.7.0.19-2.3.9.1.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk-debuginfo | 0 | 1:1.7.0.19-2.3.9.1.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk-demo | 0 | 1:1.7.0.19-2.3.9.1.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk-devel | 0 | 1:1.7.0.19-2.3.9.1.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk-javadoc | 0 | 1:1.7.0.19-2.3.9.1.el5_9 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk-src | 0 | 1:1.7.0.19-2.3.9.1.el5_9 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk-debuginfo | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk-demo | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk-devel | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk-javadoc | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk-src | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk-debuginfo | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk-demo | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk-devel | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk-javadoc | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk-src | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk-debuginfo | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk-demo | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk-devel | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk-javadoc | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk-src | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.61.1.11.11.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk-debuginfo | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk-demo | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk-devel | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk-javadoc | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk-src | 0 | 1:1.7.0.19-2.3.9.1.el6_4 |
| Red Hat:network_satellite:5.4::el5 | java-1.6.0-ibm | 0 | 1:1.6.0.14.0-1jpp.1.el5_9 |
| Red Hat:network_satellite:5.4::el5 | java-1.6.0-ibm-devel | 0 | 1:1.6.0.14.0-1jpp.1.el5_9 |
| Red Hat:network_satellite:5.4::el6 | java-1.6.0-ibm | 0 | 1:1.6.0.14.0-1jpp.1.el6_4 |
| Red Hat:network_satellite:5.4::el6 | java-1.6.0-ibm-devel | 0 | 1:1.6.0.14.0-1jpp.1.el6_4 |
| Red Hat:network_satellite:5.5::el5 | java-1.6.0-ibm | 0 | 1:1.6.0.14.0-1jpp.1.el5_9 |
| Red Hat:network_satellite:5.5::el5 | java-1.6.0-ibm-devel | 0 | 1:1.6.0.14.0-1jpp.1.el5_9 |
| Red Hat:network_satellite:5.5::el6 | java-1.6.0-ibm | 0 | 1:1.6.0.14.0-1jpp.1.el6_4 |
| Red Hat:network_satellite:5.5::el6 | java-1.6.0-ibm-devel | 0 | 1:1.6.0.14.0-1jpp.1.el6_4 |
| Red Hat:rhel_extras:5::server | java-1.5.0-ibm | 0 | 1:1.5.0.16.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.5.0-ibm-accessibility | 0 | 1:1.5.0.16.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.5.0-ibm-demo | 0 | 1:1.5.0.16.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.5.0-ibm-devel | 0 | 1:1.5.0.16.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.5.0-ibm-javacomm | 0 | 1:1.5.0.16.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.5.0-ibm-jdbc | 0 | 1:1.5.0.16.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.5.0-ibm-plugin | 0 | 1:1.5.0.16.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.5.0-ibm-src | 0 | 1:1.5.0.16.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm | 0 | 1:1.6.0.13.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-accessibility | 0 | 1:1.6.0.13.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-demo | 0 | 1:1.6.0.13.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-devel | 0 | 1:1.6.0.13.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-javacomm | 0 | 1:1.6.0.13.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-jdbc | 0 | 1:1.6.0.13.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-plugin | 0 | 1:1.6.0.13.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-src | 0 | 1:1.6.0.13.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun | 0 | 1:1.6.0.45-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun-demo | 0 | 1:1.6.0.45-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun-devel | 0 | 1:1.6.0.45-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun-jdbc | 0 | 1:1.6.0.45-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun-plugin | 0 | 1:1.6.0.45-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun-src | 0 | 1:1.6.0.45-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm | 0 | 1:1.7.0.4.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm-demo | 0 | 1:1.7.0.4.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm-devel | 0 | 1:1.7.0.4.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm-jdbc | 0 | 1:1.7.0.4.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm-plugin | 0 | 1:1.7.0.4.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm-src | 0 | 1:1.7.0.4.2-1jpp.1.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle | 0 | 1:1.7.0.21-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle-devel | 0 | 1:1.7.0.21-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle-javafx | 0 | 1:1.7.0.21-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle-jdbc | 0 | 1:1.7.0.21-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle-plugin | 0 | 1:1.7.0.21-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle-src | 0 | 1:1.7.0.21-1jpp.1.el5 |
| Red Hat:rhel_extras:6 | java-1.5.0-ibm | 0 | 1:1.5.0.16.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.5.0-ibm-demo | 0 | 1:1.5.0.16.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.5.0-ibm-devel | 0 | 1:1.5.0.16.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.5.0-ibm-javacomm | 0 | 1:1.5.0.16.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.5.0-ibm-jdbc | 0 | 1:1.5.0.16.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.5.0-ibm-plugin | 0 | 1:1.5.0.16.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.5.0-ibm-src | 0 | 1:1.5.0.16.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm | 0 | 1:1.6.0.13.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-demo | 0 | 1:1.6.0.13.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-devel | 0 | 1:1.6.0.13.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-javacomm | 0 | 1:1.6.0.13.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-jdbc | 0 | 1:1.6.0.13.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-plugin | 0 | 1:1.6.0.13.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-src | 0 | 1:1.6.0.13.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun | 0 | 1:1.6.0.45-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun-demo | 0 | 1:1.6.0.45-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun-devel | 0 | 1:1.6.0.45-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun-jdbc | 0 | 1:1.6.0.45-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun-plugin | 0 | 1:1.6.0.45-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun-src | 0 | 1:1.6.0.45-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm | 0 | 1:1.7.0.4.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm-demo | 0 | 1:1.7.0.4.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm-devel | 0 | 1:1.7.0.4.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm-jdbc | 0 | 1:1.7.0.4.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm-plugin | 0 | 1:1.7.0.4.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm-src | 0 | 1:1.7.0.4.2-1jpp.1.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle | 0 | 1:1.7.0.21-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle-devel | 0 | 1:1.7.0.21-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle-javafx | 0 | 1:1.7.0.21-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle-jdbc | 0 | 1:1.7.0.21-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle-plugin | 0 | 1:1.7.0.21-1jpp.1.el6 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle-src | 0 | 1:1.7.0.21-1jpp.1.el6 |
| openSUSE:Tumbleweed | java-1_7_0-openjdk | 0 | 1.7.0.121-1.1 |
Related vulnerabilities
- CVE-2016-5542 Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded… Also affects java-1.6.0-openjdk
- CVE-2016-3458 Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded… Also affects java-1.6.0-openjdk
- CVE-2016-3427 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… Also affects java-1.6.0-openjdk
- CVE-2016-0686 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded… Also affects java-1.6.0-openjdk
- CVE-2016-0483 Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65… Also affects java-1.6.0-openjdk
- CVE-2015-4734 Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded… Also affects java-1.6.0-openjdk
- CVE-2015-4748 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and… Also affects java-1.6.0-openjdk
- CVE-2015-2590 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… Also affects java-1.6.0-openjdk