CVE-2013-2465: Oracle Java SE Unspecified Vulnerability

CVSS: 10.0v2.0HighKEVRansomwareAnalyzed

Published 18-06-2013Last modified 22-10-2025

Vulnerability summary

CVE-2013-2465 is a high (CVSS 10.0) Protection Mechanism Failure vulnerability in Oracle Java SE. It is known to be exploited: CISA lists it, first on 28-03-2022. It has been used in ransomware campaigns. EPSS estimates a 98.80% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

100/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

98.80%

0%100%

Critical · 0.00 pp in 30 days

KEVListedCISA

RansomwareKnown useFlagged by CISA

Public exploits4reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 15 · Related 1

DSA-2722-1 DSA-2727-1 MGASA-2013-0185 MGASA-2013-0208 OPENSUSE-SU-2024:10534-1 RHSA-2013:0957+9 more

Timeline

18-06-2013
PublishedVulnerability first disclosed.
28-03-2022
Added to CISA KEVOracle Java SE Unspecified Vulnerability
18-04-2022
CISA remediation dueApply updates per vendor instructions.
22-10-2025
Last modifiedVulnerability information updated.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.19.8v2.010.0

EPSS trend

Probability

98.80%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 98.80% on 19-09-2026

19-09-202619-10-2026

EPSS score

98.80%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 28-03-2022
Federal due date: 18-04-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2013-2465

Public exploits

4 found

referenceUnverified
Exploit Reference (vicarius.io)
Maturity: unknown
referenceUnverified
Exploit Reference (vicarius.io)
Maturity: unknown
exploit-databaseremotemultipleVerified
Java - 'storeImageArray()' Invalid Array Indexing (Metasploit)
Maturity: weaponized

Show all 4 exploits

MetasploitremoteVerified
Java storeImageArray() Invalid Array Indexing Vulnerability
exploit/multi/browser/java_storeimagearray
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Affected systems

Suse4 products

linux_enterprise_desktop10:sp4
linux_enterprise_java10:sp4 | 11:sp2 | 11:sp3
linux_enterprise_server10:sp3 | 10:sp4 | 11:sp2 | 11:sp3
linux_enterprise_software_development_kit11:sp2 | 11:sp3

Oracle1 product

jre1.7.0 | 1.7.0:update1 | 1.7.0:update10 | 1.7.0:update11 | 1.7.0:update13 | 1.7.0:update15 | 1.7.0:update17 | 1.7.0:update2 | 1.7.0:update21 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6 | 1.7.0:update7 | 1.7.0:update9 | 1.6.0 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.6.0:update33 | 1.6.0:update34 | 1.6.0:update35 | 1.6.0:update37 | 1.6.0:update38 | 1.6.0:update39 | 1.6.0:update41 | 1.6.0:update43 | 1.6.0:update45 | 1.5.0 | 1.5.0:update36 | 1.5.0:update38 | 1.5.0:update39 | 1.5.0:update40 | 1.5.0:update41 | 1.5.0:update45

Sun1 product

jre1.6.0:update_1 | 1.6.0:update_10 | 1.6.0:update_11 | 1.6.0:update_12 | 1.6.0:update_13 | 1.6.0:update_14 | 1.6.0:update_15 | 1.6.0:update_16 | 1.6.0:update_17 | 1.6.0:update_18 | 1.6.0:update_19 | 1.6.0:update_20 | 1.6.0:update_21 | 1.6.0:update_3 | 1.6.0:update_4 | 1.6.0:update_5 | 1.6.0:update_6 | 1.6.0:update_7 | 1.6.0:update_9 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update15 | 1.5.0:update16 | 1.5.0:update17 | 1.5.0:update18 | 1.5.0:update19 | 1.5.0:update2 | 1.5.0:update20 | 1.5.0:update21 | 1.5.0:update22 | 1.5.0:update23 | 1.5.0:update24 | 1.5.0:update25 | 1.5.0:update26 | 1.5.0:update27 | 1.5.0:update28 | 1.5.0:update29 | 1.5.0:update3 | 1.5.0:update31 | 1.5.0:update33 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update8 | 1.5.0:update9

3 vendors · 6 products

References

34 links

rhn.redhat.com/errata/RHSA-2013-1060.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
marc.info?l=bugtraq&m=137545592101387&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2014:0414Vendor AdvisoryX Refsource REDHATThird Party Advisory
security.gentoo.org/glsa/glsa-201406-32.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.securityfocus.com/bid/60657VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.htmlX Refsource CONFIRMVendor Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
marc.info?l=bugtraq&m=137545505800971&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory

Show all 34 references

secunia.com/advisories/54154Third Party AdvisoryX Refsource SECUNIANot Applicable
rhn.redhat.com/errata/RHSA-2013-1455.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880Vendor AdvisoryX Refsource HPBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19455VDB EntrySignatureX Refsource OVALBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19703VDB EntrySignatureX Refsource OVALBroken Link
hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040X Refsource MISCPatch
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19074VDB EntrySignatureX Refsource OVALBroken Link
lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2013-1059.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17106VDB EntrySignatureX Refsource OVALBroken Link
rhn.redhat.com/errata/RHSA-2013-1081.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.us-cert.gov/ncas/alerts/TA13-169AThird Party AdvisoryX Refsource CERTUS Government Resource
advisories.mageia.org/MGASA-2013-0185.htmlX Refsource CONFIRMBroken Link
rhn.redhat.com/errata/RHSA-2013-0963.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=975118X Refsource CONFIRMIssue Tracking
rhn.redhat.com/errata/RHSA-2013-1456.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2013:183Vendor AdvisoryX Refsource MANDRIVANot Applicable
www-01.ibm.com/support/docview.wss?uid=swg21642336X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.vicarius.io/vsociety/posts/cve-2013-2465-detect-java-vulnerabilityExploitThird Party Advisory
www.vicarius.io/vsociety/posts/cve-2013-2465-mitigate-java-vulnerabilityExploitThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2465Government ResourceUS Government Resource

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities