CVE-2013-0428: Critical severity oracle jre vulnerability
A flaw was found in the Java refection API in the handling of access privileges of proxy classes. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.240 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What are the affected software versions for CVE-2013-0428?
CVE-2013-0428 affects Oracle Java Runtime Environment versions 1.5.0 through 1.7.0_update38, along with specific versions of IcedTea.
What is the severity rating of CVE-2013-0428?
CVE-2013-0428 has been assigned a severity rating of 7.5, which indicates high severity.
How can I mitigate CVE-2013-0428?
To mitigate CVE-2013-0428, update your Java Runtime Environment to version 1.7.0_update39 or later.
What is the nature of the vulnerability in CVE-2013-0428?
CVE-2013-0428 is a vulnerability in the Java reflection API that allows unauthorized access to classes and methods.
Are there any known exploits for CVE-2013-0428?
Yes, there are known exploits for CVE-2013-0428 that may allow attackers to bypass JVM sandbox protections.