CVE-2013-2465

oracle jre, sun jre, suse linux enterprise desktop

Published 18 Jun 2013 · updated 16 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, CISA ADP

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 28 Mar 2022, with a remediation deadline of 18 Apr 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

References

advisories.mageia.org/MGASA-2013-0185.html · Broken Link
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880 · Broken Link
hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040 · Patch
lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html · Mailing List, Third Party Advisory
marc.info/?l=bugtraq&m=137545505800971&w=2 · Mailing List, Third Party Advisory
marc.info/?l=bugtraq&m=137545592101387&w=2 · Mailing List, Third Party Advisory
rhn.redhat.com/errata/RHSA-2013-0963.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2013-1059.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2013-1060.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2013-1081.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2013-1455.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2013-1456.html · Third Party Advisory
secunia.com/advisories/54154 · Not Applicable
security.gentoo.org/glsa/glsa-201406-32.xml · Third Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21642336 · Third Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2013:183 · Not Applicable
www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html · Vendor Advisory
www.securityfocus.com/bid/60657 · Broken Link, Third Party Advisory, VDB Entry
www.us-cert.gov/ncas/alerts/TA13-169A · Third Party Advisory, US Government Resource