CVE-2013-2420: Critical severity ORACLE JRE vulnerability
It was discovered that the 2D component did not properly process certain images. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to insufficient "validation of images" in share/native/sun/awt/image/awtImageRep.c, possibly involving offsets.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2420?
CVE-2013-2420 is classified as a high severity vulnerability due to its potential to bypass Java sandbox restrictions.
How do I fix CVE-2013-2420?
To fix CVE-2013-2420, update to the latest version of Java or IcedTea packages, specifically avoiding versions prior to 1.11.10 for IcedTea6 and 2.3.9 for IcedTea7.
What versions of Java are affected by CVE-2013-2420?
CVE-2013-2420 affects Oracle Java SE 7 Update 17 and earlier versions as well as several older IcedTea packages.
Is there a workaround for CVE-2013-2420?
Disabling the Java plugin in web browsers is a temporary workaround for CVE-2013-2420 until updates can be applied.
Which systems are vulnerable to CVE-2013-2420?
Systems running affected versions of Oracle Java Runtime Environment and IcedTea packages are vulnerable to CVE-2013-2420.