CVE-2013-1493: oracle jdk
CVSS: 10.0v2.0HighModified
AliasesCGA-2g6c-fpjf-qgq3CGA-2x7w-cwq5-xx66CGA-47x6-jvjm-8246CGA-4ww6-2m22-22rrCGA-5rc9-4j6j-vvwrCGA-5vw9-w26f-w98wCGA-5vwc-77vc-c9wgCGA-5wxc-gfw4-hfc7CGA-68mh-3h47-rcm4CGA-6qhq-wmcq-7xwhCGA-89vx-g922-f2p4CGA-8jgw-42pp-hfw8CGA-9vmw-96q6-gx9qCGA-f44c-5rqw-g9w7CGA-fc24-62x4-2q3pCGA-g2h3-84m2-hrg9CGA-g654-w3vh-wf5pCGA-gqmw-wvhf-g8x7CGA-jfjj-26v4-xg6vCGA-m574-p4gx-qxcqCGA-m5fj-j3f7-q9vwCGA-mv6m-j983-9jrrCGA-pc8p-r85p-v9q8CGA-q47f-q877-w8g6CGA-qg5p-mp5m-7mvhCGA-qqhr-6hxm-h57fCGA-rm82-5995-rf75CGA-rqxh-j7m5-fc52CGA-v8xg-prr3-q22pCGA-vm69-8mjh-2hv6CGA-wf23-37q8-6jrvCGA-xvw9-x3h4-cc45
Published 04-03-2013Last modified 06-08-2024
Vulnerability summary
CVE-2013-1493 is a high (CVSS 10.0) vulnerability in oracle jdk. EPSS estimates a 86.15% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
10.0/10
010
High · v2.0 (NVD)EPSS score
86.15%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2exploit-database, metasploit
Advisory lineage
Upstream 0 · Downstream 12 · Related 6Timeline
- 04-03-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
CVSS metrics
1 score · 1 source · 1 versionHigh 10.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
86.15%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 86.15% on 18-09-2026
18-09-202618-10-2026
EPSS score86.15%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundJava CMM - Remote Code Execution (Metasploit)
Maturity: weaponized
Java CMM Remote Code Execution
exploit/windows/browser/java_cmm
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard16 products
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.48.0-r2
- openjdk-25-openj9< 0.59.0-r1
- openjdk-25-openj9-dbg< 0.59.0-r1
Oracle2 products
- jdk≤ 1.6.0 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.6.0:update33 | 1.6.0:update34 | 1.6.0:update35 | 1.6.0:update37 | 1.6.0:update38 | 1.6.0:update39 | ≤ 1.5.0 | 1.5.0:update36 | 1.5.0:update38 | ≤ 1.7.0 | 1.7.0 | 1.7.0:update1 | 1.7.0:update10 | 1.7.0:update11 | 1.7.0:update13 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6 | 1.7.0:update7 | 1.7.0:update9
- jre≤ 1.7.0 | 1.7.0 | 1.7.0:update1 | 1.7.0:update10 | 1.7.0:update11 | 1.7.0:update13 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6 | 1.7.0:update7 | 1.7.0:update9 | ≤ 1.5.0 | 1.5.0:update36 | 1.5.0:update38 | ≤ 1.6.0 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.6.0:update33 | 1.6.0:update34 | 1.6.0:update35 | 1.6.0:update37 | 1.6.0:update38 | 1.6.0:update39
Sun2 products
- jdk1.6.0 | 1.6.0:update_10 | 1.6.0:update_11 | 1.6.0:update_12 | 1.6.0:update_13 | 1.6.0:update_14 | 1.6.0:update_15 | 1.6.0:update_16 | 1.6.0:update_17 | 1.6.0:update_18 | 1.6.0:update_19 | 1.6.0:update_20 | 1.6.0:update_21 | 1.6.0:update_3 | 1.6.0:update_4 | 1.6.0:update_5 | 1.6.0:update_6 | 1.6.0:update_7 | 1.6.0:update1 | 1.6.0:update1_b06 | 1.6.0:update2 | 1.5.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update11_b03 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update15 | 1.5.0:update16 | 1.5.0:update17 | 1.5.0:update18 | 1.5.0:update19 | 1.5.0:update2 | 1.5.0:update20 | 1.5.0:update21 | 1.5.0:update22 | 1.5.0:update23 | 1.5.0:update24 | 1.5.0:update25 | 1.5.0:update26 | 1.5.0:update27 | 1.5.0:update28 | 1.5.0:update29 | 1.5.0:update3 | 1.5.0:update31 | 1.5.0:update33 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update7_b03 | 1.5.0:update8 | 1.5.0:update9
- jre1.5.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update15 | 1.5.0:update16 | 1.5.0:update17 | 1.5.0:update18 | 1.5.0:update19 | 1.5.0:update2 | 1.5.0:update20 | 1.5.0:update21 | 1.5.0:update22 | 1.5.0:update23 | 1.5.0:update24 | 1.5.0:update25 | 1.5.0:update26 | 1.5.0:update27 | 1.5.0:update28 | 1.5.0:update29 | 1.5.0:update3 | 1.5.0:update31 | 1.5.0:update33 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update8 | 1.5.0:update9 | 1.6.0 | 1.6.0:update_1 | 1.6.0:update_10 | 1.6.0:update_11 | 1.6.0:update_12 | 1.6.0:update_13 | 1.6.0:update_14 | 1.6.0:update_15 | 1.6.0:update_16 | 1.6.0:update_17 | 1.6.0:update_18 | 1.6.0:update_19 | 1.6.0:update_2 | 1.6.0:update_20 | 1.6.0:update_21 | 1.6.0:update_3 | 1.6.0:update_4 | 1.6.0:update_5 | 1.6.0:update_6 | 1.6.0:update_7 | 1.6.0:update_9
3 vendors · 20 products
References
31 links- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19246VDB EntrySignatureX Refsource OVAL
- www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.htmlX Refsource CONFIRM
Show all 31 references
- twitter.com/jduck1337/status/307629902574800897X Refsource MISC
- www.oracle.com/ocom/groups/public/%40otn/documents/webcontent/1915099.xmlX Refsource CONFIRM
- bugzilla.redhat.com/show_bug.cgi?id=917553X Refsource CONFIRM
- wiki.mageia.org/en/Support/Advisories/MGASA-2013-0088X Refsource CONFIRM
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19477VDB EntrySignatureX Refsource OVAL