CVE-2013-2419: Medium severity ORACLE JRE vulnerability
It was discovered that the 2D component did not properly process certain fonts. An untrusted Java application or applet could possibly use this flaw to crash the Java VM.
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font processing errors" in the International Components for Unicode (ICU) Layout Engine before 51.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2419?
CVE-2013-2419 is considered a critical severity vulnerability that can lead to potential crashes of the Java Virtual Machine.
How do I fix CVE-2013-2419?
To fix CVE-2013-2419, upgrade to a newer version of the affected Java Runtime Environment or JDK that includes the necessary security patches.
What software versions are affected by CVE-2013-2419?
CVE-2013-2419 affects Oracle Java SE 7 Update 17 and earlier, along with specific versions of IcedTea.
Can CVE-2013-2419 be exploited remotely?
Yes, CVE-2013-2419 could potentially be exploited by an untrusted Java application or applet to crash the Java VM.
Is there a workaround for CVE-2013-2419?
There is no direct workaround for CVE-2013-2419; the recommended action is to apply the latest updates to affected software.