CVE-2013-2461

EXPLOITED

Oracle Java SE <7 Update 21 & <6 Update 45 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2013-2461 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a "Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm."

References (22)

Core 22
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=137545592101387&w=2
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2014:0414
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201406-32.xml
Third Party Advisory x_refsource_confirm
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=137545505800971&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/54154
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/534161/100/0/threaded
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Dec/23
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/ncas/alerts/TA13-169A
Third Party Advisory x_refsource_confirm
http://advisories.mageia.org/MGASA-2013-0185.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0963.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/60645
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2013:183
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=975126

Scores

EPSS 0.7090
EPSS Percentile 98.7%

Details

VulnCheck KEV 2024-05-06
Status published
Products (5)
oracle/jdk 1.6.0 update22 (18 CPE variants)
oracle/jre 1.7.0 (14 CPE variants)
oracle/jrockit r27.7.1 - r27.7.5
oracle/openjdk 1.7.0
sun/jdk 1.6.0 (16 CPE variants)
Published Jun 18, 2013
Tracked Since Feb 18, 2026