CVE-2013-2421: Critical severity ORACLE JRE vulnerability
It was discovered that the Hotspot component did not properly perform certain MethodHandle lookups. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect MethodHandle lookups, which allows remote attackers to bypass Java sandbox restrictions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2421?
CVE-2013-2421 is rated as a critical vulnerability due to its potential to allow untrusted Java applications to bypass sandbox restrictions.
How do I fix CVE-2013-2421?
To fix CVE-2013-2421, upgrade to the latest version of affected Java packages, including IcedTea6 version 1.11.10 or IcedTea7 version 2.3.9.
What systems are affected by CVE-2013-2421?
CVE-2013-2421 affects various versions of Oracle JRE and JDK, specifically those prior to update17 for Java 7.
What is the potential impact of CVE-2013-2421?
The potential impact of CVE-2013-2421 includes unauthorized access and execution of untrusted code outside the Java sandbox.
How can I determine if my system is vulnerable to CVE-2013-2421?
You can determine vulnerability to CVE-2013-2421 by checking if you are using any affected versions of Oracle JRE or JDK prior to their patched updates.