CVE-2013-1518: Critical severity ORACLE JRE vulnerability
It was discovered that the JAXP component lacked certain security restrictions. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1518?
CVE-2013-1518 is classified as a high severity vulnerability that can lead to bypassing Java sandbox restrictions.
How do I fix CVE-2013-1518?
To fix CVE-2013-1518, update Oracle Java SE 7 to version 1.7.0_21 or later.
What causes the CVE-2013-1518 vulnerability?
CVE-2013-1518 is caused by the JAXP component lacking proper security restrictions allowing untrusted Java applications to bypass the sandbox.
Which versions are affected by CVE-2013-1518?
CVE-2013-1518 affects Oracle Java SE 7 Update 17 and earlier versions, as well as certain versions of the JDK and JRE.
Is there a workaround for CVE-2013-1518 until I can patch?
Disabling the Java plugin in the web browser is a temporary workaround to mitigate the risks of CVE-2013-1518.