CVE-2013-0967: Medium severity Apple iOS and macOS vulnerability
Published Mar 15, 2013
·Updated
CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attackers to bypass a Java plug-in disabled setting, and trigger the launch of Java Web Start applications, via a crafted web site.
Affected Software
13 affected components
Apple iOS and macOS=10.7.0
Apple iOS and macOS=10.7.1
Apple iOS and macOS=10.7.2
Apple iOS and macOS=10.7.3
Apple iOS and macOS=10.7.4
Apple iOS and macOS=10.7.5
Apple Mac OS X Server=10.7.0
Apple Mac OS X Server=10.7.1
Apple Mac OS X Server=10.7.2
Apple Mac OS X Server=10.7.3
Apple iOS and macOS=10.8.0
Apple iOS and macOS=10.8.1
Apple iOS and macOS=10.8.2
Event History
Mar 15, 2013
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-0967?
CVE-2013-0967 is rated as a medium severity vulnerability due to its ability to bypass Java plug-in settings.
2
How do I fix CVE-2013-0967?
To fix CVE-2013-0967, upgrade your Apple Mac OS X to version 10.8.3 or later.
3
What systems are affected by CVE-2013-0967?
CVE-2013-0967 affects Apple Mac OS X versions from 10.7.0 up to 10.8.2.
4
What kind of attack does CVE-2013-0967 enable?
CVE-2013-0967 enables attackers to launch Java Web Start applications remotely via malicious JNLP files.
5
Is CVE-2013-0967 a remote code execution vulnerability?
Yes, CVE-2013-0967 can lead to remote code execution by exploiting the Java Web Start vulnerability.