CVE-2013-1557: Critical severity ORACLE JRE vulnerability
It was discovered that LogStream.setDefaultStream() is missing security restrictions. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions" in the LogStream.setDefaultStream method.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1557?
CVE-2013-1557 has a high severity rating due to its potential to allow untrusted Java applications to bypass sandbox restrictions.
How do I fix CVE-2013-1557?
To fix CVE-2013-1557, update to the recommended versions of the affected software including IcedTea6 1.11.10, IcedTea7 2.3.9, or Oracle JRE/JDK versions later than 1.7.0-update17.
Which versions of Java are affected by CVE-2013-1557?
CVE-2013-1557 affects Oracle Java SE 7 Update 17 and earlier, as well as various updates of IcedTea6 and IcedTea7.
Is there a workaround for CVE-2013-1557 if I cannot update?
The best workaround for CVE-2013-1557 is to disable the execution of untrusted Java applets in your browser settings until an update can be applied.
What type of vulnerability is CVE-2013-1557 classified as?
CVE-2013-1557 is classified as a security vulnerability in the Java Runtime Environment that results in bypassing of security restrictions.