CVE-2013-2463: oracle jdk

CVSS: 10.0v2.0HighModified

AliasesCGA-2j45-fh2f-rp5mCGA-2j7m-5q8p-hr4gCGA-34mx-mrqc-93cc+29 more

Published 18-06-2013Last modified 06-08-2024

Vulnerability summary

CVE-2013-2463 is a high (CVSS 10.0) vulnerability in oracle jdk. EPSS estimates a 10.18% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

10.18%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 5

DSA-2722-1 DSA-2727-1 MGASA-2013-0185 MGASA-2013-0208 OPENSUSE-SU-2024:10534-1 RHSA-2013:0957+13 more

Timeline

18-06-2013
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image attribute verification" in 2D.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

10.18%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 10.18% on 18-09-2026

18-09-202618-10-2026

EPSS score

10.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Chainguard16 products

openjdk-11-openj9-default-policy< 0.53.0-r0
openjdk-17-openj9-default-policy< 0.53.0-r0
openjdk-21-openj9-default-policy< 0.48.0-r2
openjdk-25-openj9< 0.59.0-r1
openjdk-25-openj9-dbg< 0.59.0-r1

Show all 16

Oracle2 products

jdk≤ 1.7.0 | 1.7.0 | 1.7.0:update1 | 1.7.0:update10 | 1.7.0:update11 | 1.7.0:update13 | 1.7.0:update15 | 1.7.0:update17 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6 | 1.7.0:update7 | 1.7.0:update9 | ≤ 1.6.0 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.6.0:update33 | 1.6.0:update34 | 1.6.0:update35 | 1.6.0:update37 | 1.6.0:update38 | 1.6.0:update39 | 1.6.0:update41 | 1.6.0:update43 | ≤ 1.5.0 | 1.5.0:update36 | 1.5.0:update38 | 1.5.0:update39 | 1.5.0:update40 | 1.5.0:update41
jre≤ 1.7.0 | 1.7.0 | 1.7.0:update1 | 1.7.0:update10 | 1.7.0:update11 | 1.7.0:update13 | 1.7.0:update15 | 1.7.0:update17 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6 | 1.7.0:update7 | 1.7.0:update9 | ≤ 1.6.0 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.6.0:update33 | 1.6.0:update34 | 1.6.0:update35 | 1.6.0:update37 | 1.6.0:update38 | 1.6.0:update39 | 1.6.0:update41 | 1.6.0:update43 | ≤ 1.5.0 | 1.5.0:update36 | 1.5.0:update38 | 1.5.0:update39 | 1.5.0:update40 | 1.5.0:update41

Sun2 products

jdk1.6.0 | 1.6.0:update_10 | 1.6.0:update_11 | 1.6.0:update_12 | 1.6.0:update_13 | 1.6.0:update_14 | 1.6.0:update_15 | 1.6.0:update_16 | 1.6.0:update_17 | 1.6.0:update_18 | 1.6.0:update_19 | 1.6.0:update_20 | 1.6.0:update_21 | 1.6.0:update_3 | 1.6.0:update_4 | 1.6.0:update_5 | 1.6.0:update_6 | 1.6.0:update_7 | 1.6.0:update1 | 1.6.0:update1_b06 | 1.6.0:update2 | 1.5.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update11_b03 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update15 | 1.5.0:update16 | 1.5.0:update17 | 1.5.0:update18 | 1.5.0:update19 | 1.5.0:update2 | 1.5.0:update20 | 1.5.0:update21 | 1.5.0:update22 | 1.5.0:update23 | 1.5.0:update24 | 1.5.0:update25 | 1.5.0:update26 | 1.5.0:update27 | 1.5.0:update28 | 1.5.0:update29 | 1.5.0:update3 | 1.5.0:update31 | 1.5.0:update33 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update7_b03 | 1.5.0:update8 | 1.5.0:update9
jre1.6.0 | 1.6.0:update_1 | 1.6.0:update_10 | 1.6.0:update_11 | 1.6.0:update_12 | 1.6.0:update_13 | 1.6.0:update_14 | 1.6.0:update_15 | 1.6.0:update_16 | 1.6.0:update_17 | 1.6.0:update_18 | 1.6.0:update_19 | 1.6.0:update_2 | 1.6.0:update_20 | 1.6.0:update_21 | 1.6.0:update_3 | 1.6.0:update_4 | 1.6.0:update_5 | 1.6.0:update_6 | 1.6.0:update_7 | 1.6.0:update_9 | 1.5.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update15 | 1.5.0:update16 | 1.5.0:update17 | 1.5.0:update18 | 1.5.0:update19 | 1.5.0:update2 | 1.5.0:update20 | 1.5.0:update21 | 1.5.0:update22 | 1.5.0:update23 | 1.5.0:update24 | 1.5.0:update25 | 1.5.0:update26 | 1.5.0:update27 | 1.5.0:update28 | 1.5.0:update29 | 1.5.0:update3 | 1.5.0:update31 | 1.5.0:update33 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update8 | 1.5.0:update9

3 vendors · 20 products

References

32 links

rhn.redhat.com/errata/RHSA-2013-1060.htmlVendor AdvisoryX Refsource REDHAT
marc.info?l=bugtraq&m=137545592101387&w=2Vendor AdvisoryX Refsource HP
access.redhat.com/errata/RHSA-2014:0414Vendor AdvisoryX Refsource REDHAT
security.gentoo.org/glsa/glsa-201406-32.xmlVendor AdvisoryX Refsource GENTOO
www.securityfocus.com/bid/60655VDB EntryX Refsource BID
bugzilla.redhat.com/show_bug.cgi?id=975115X Refsource CONFIRM
www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.htmlX Refsource CONFIRMVendor Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.htmlVendor AdvisoryX Refsource SUSE
marc.info?l=bugtraq&m=137545505800971&w=2Vendor AdvisoryX Refsource HP

Show all 32 references

lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/54154Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2013-1455.htmlVendor AdvisoryX Refsource REDHAT
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880Vendor AdvisoryX Refsource HP
lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.htmlVendor AdvisoryX Refsource SUSE
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19620VDB EntrySignatureX Refsource OVAL
rhn.redhat.com/errata/RHSA-2013-1059.htmlVendor AdvisoryX Refsource REDHAT
hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b79d56eee18eX Refsource MISC
www.informationweek.com/security/vulnerabilities/hackers-target-java-6-with-security-expl/240160443X Refsource MISC
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17149VDB EntrySignatureX Refsource OVAL
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19373VDB EntrySignatureX Refsource OVAL
lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.htmlVendor AdvisoryX Refsource SUSE
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19685VDB EntrySignatureX Refsource OVAL
rhn.redhat.com/errata/RHSA-2013-1081.htmlVendor AdvisoryX Refsource REDHAT
www.us-cert.gov/ncas/alerts/TA13-169AThird Party AdvisoryX Refsource CERTUS Government Resource
advisories.mageia.org/MGASA-2013-0185.htmlX Refsource CONFIRM
rhn.redhat.com/errata/RHSA-2013-0963.htmlVendor AdvisoryX Refsource REDHAT
lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.htmlVendor AdvisoryX Refsource SUSE
rhn.redhat.com/errata/RHSA-2013-1456.htmlVendor AdvisoryX Refsource REDHAT
www.mandriva.com/security/advisories?name=MDVSA-2013:183Vendor AdvisoryX Refsource MANDRIVA
www-01.ibm.com/support/docview.wss?uid=swg21642336X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.htmlVendor AdvisoryX Refsource SUSE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities