CVE-2013-1537: oracle jdk

Modified

AliasesCGA-29g9-9c37-93fwCGA-2q4m-3rrm-hx4mCGA-3g4x-pc44-9f5m+29 more

Published 17-04-2013Last modified 06-08-2024

Vulnerability summary

CVE-2013-1537 is a high (CVSS 10.0) vulnerability in oracle jdk. EPSS estimates a 9.88% chance of exploitation in the next 30 days, higher than 95.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 10, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

9.88%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 6

OPENSUSE-SU-2024:10534-1 RHSA-2013:0751 RHSA-2013:0752 RHSA-2013:0757 RHSA-2013:0758 RHSA-2013:0770+10 more

Timeline

17-04-2013
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false, which allows remote attackers to perform "dynamic class downloading" and execute arbitrary code.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

9.88%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 9.88% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Chainguard16 products

openjdk-11-openj9-default-policy< 0.53.0-r0
openjdk-17-openj9-default-policy< 0.53.0-r0
openjdk-21-openj9-default-policy< 0.48.0-r2
openjdk-25-openj9< 0.59.0-r1
openjdk-25-openj9-dbg< 0.59.0-r1

Show all 16

Oracle2 products

jdk≤ 1.7.0 | 1.7.0 | 1.7.0:update1 | 1.7.0:update10 | 1.7.0:update11 | 1.7.0:update13 | 1.7.0:update15 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6 | 1.7.0:update7 | 1.7.0:update9 | ≤ 1.6.0 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.6.0:update33 | 1.6.0:update34 | 1.6.0:update35 | 1.6.0:update37 | 1.6.0:update38 | 1.6.0:update39 | 1.6.0:update41 | ≤ 1.5.0 | 1.5.0:update36 | 1.5.0:update38 | 1.5.0:update40
jre≤ 1.7.0 | 1.7.0 | 1.7.0:update1 | 1.7.0:update10 | 1.7.0:update11 | 1.7.0:update13 | 1.7.0:update15 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6 | 1.7.0:update7 | 1.7.0:update9 | ≤ 1.6.0 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.6.0:update33 | 1.6.0:update34 | 1.6.0:update35 | 1.6.0:update37 | 1.6.0:update38 | 1.6.0:update39 | 1.6.0:update41 | ≤ 1.5.0 | 1.5.0:update36 | 1.5.0:update38 | 1.5.0:update40

Sun2 products

jdk1.6.0 | 1.6.0:update_10 | 1.6.0:update_11 | 1.6.0:update_12 | 1.6.0:update_13 | 1.6.0:update_14 | 1.6.0:update_15 | 1.6.0:update_16 | 1.6.0:update_17 | 1.6.0:update_18 | 1.6.0:update_19 | 1.6.0:update_20 | 1.6.0:update_21 | 1.6.0:update_3 | 1.6.0:update_4 | 1.6.0:update_5 | 1.6.0:update_6 | 1.6.0:update_7 | 1.6.0:update1 | 1.6.0:update1_b06 | 1.6.0:update2 | 1.5.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update11_b03 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update15 | 1.5.0:update16 | 1.5.0:update17 | 1.5.0:update18 | 1.5.0:update19 | 1.5.0:update2 | 1.5.0:update20 | 1.5.0:update21 | 1.5.0:update22 | 1.5.0:update23 | 1.5.0:update24 | 1.5.0:update25 | 1.5.0:update26 | 1.5.0:update27 | 1.5.0:update28 | 1.5.0:update29 | 1.5.0:update3 | 1.5.0:update31 | 1.5.0:update33 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update7_b03 | 1.5.0:update8 | 1.5.0:update9
jre1.6.0 | 1.6.0:update_1 | 1.6.0:update_10 | 1.6.0:update_11 | 1.6.0:update_12 | 1.6.0:update_13 | 1.6.0:update_14 | 1.6.0:update_15 | 1.6.0:update_16 | 1.6.0:update_17 | 1.6.0:update_18 | 1.6.0:update_19 | 1.6.0:update_2 | 1.6.0:update_20 | 1.6.0:update_21 | 1.6.0:update_3 | 1.6.0:update_4 | 1.6.0:update_5 | 1.6.0:update_6 | 1.6.0:update_7 | 1.6.0:update_9 | 1.5.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update15 | 1.5.0:update16 | 1.5.0:update17 | 1.5.0:update18 | 1.5.0:update19 | 1.5.0:update2 | 1.5.0:update20 | 1.5.0:update21 | 1.5.0:update22 | 1.5.0:update23 | 1.5.0:update24 | 1.5.0:update25 | 1.5.0:update26 | 1.5.0:update27 | 1.5.0:update28 | 1.5.0:update29 | 1.5.0:update3 | 1.5.0:update31 | 1.5.0:update33 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update8 | 1.5.0:update9

3 vendors · 20 products

References

36 links

lists.opensuse.org/opensuse-security-announce/2013-05/msg00013.htmlVendor AdvisoryX Refsource SUSE
www.oracle.com/technetwork/java/javase/7u21-relnotes-1932873.htmlX Refsource MISC
security.gentoo.org/glsa/glsa-201406-32.xmlVendor AdvisoryX Refsource GENTOO
mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.htmlMailing ListX Refsource MLIST
lists.opensuse.org/opensuse-security-announce/2013-06/msg00001.htmlVendor AdvisoryX Refsource SUSE
rhn.redhat.com/errata/RHSA-2013-0758.htmlVendor AdvisoryX Refsource REDHAT
www.security-explorations.com/en/SE-2012-01-details.htmlX Refsource MISC
lists.apple.com/archives/security-announce/2013/Apr/msg00001.htmlVendor AdvisoryX Refsource APPLE
www.mandriva.com/security/advisories?name=MDVSA-2013:145Vendor AdvisoryX Refsource MANDRIVA
www.us-cert.gov/ncas/alerts/TA13-107AThird Party AdvisoryX Refsource CERTUS Government Resource

Show all 36 references

blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/X Refsource CONFIRM
marc.info?l=bugtraq&m=137283787217316&w=2Vendor AdvisoryX Refsource HP
wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130X Refsource CONFIRM
icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/096ed306159fX Refsource CONFIRM
rhn.redhat.com/errata/RHSA-2013-1455.htmlVendor AdvisoryX Refsource REDHAT
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880Vendor AdvisoryX Refsource HP
rhn.redhat.com/errata/RHSA-2013-0757.htmlVendor AdvisoryX Refsource REDHAT
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16578VDB EntrySignatureX Refsource OVAL
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19385VDB EntrySignatureX Refsource OVAL
wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124X Refsource CONFIRM
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19550VDB EntrySignatureX Refsource OVAL
lists.opensuse.org/opensuse-updates/2013-05/msg00017.htmlVendor AdvisoryX Refsource SUSE
www.mandriva.com/security/advisories?name=MDVSA-2013:161Vendor AdvisoryX Refsource MANDRIVA
www.securityfocus.com/bid/59194VDB EntryX Refsource BID
lists.opensuse.org/opensuse-updates/2013-06/msg00099.htmlVendor AdvisoryX Refsource SUSE
rhn.redhat.com/errata/RHSA-2013-0752.htmlVendor AdvisoryX Refsource REDHAT
bugzilla.redhat.com/show_bug.cgi?id=952387X Refsource MISC
hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/f098e2297ff1X Refsource CONFIRM
www.ubuntu.com/usn/USN-1806-1Vendor AdvisoryX Refsource UBUNTU
rhn.redhat.com/errata/RHSA-2013-1456.htmlVendor AdvisoryX Refsource REDHAT
seclists.org/fulldisclosure/2013/Feb/18Mailing ListX Refsource FULLDISC
lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.htmlVendor AdvisoryX Refsource SUSE
www.mandriva.com/security/advisories?name=MDVSA-2013:150Vendor AdvisoryX Refsource MANDRIVA
www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.htmlX Refsource CONFIRMVendor Advisory
blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2013-06/msg00007.htmlVendor AdvisoryX Refsource SUSE