CVE-2013-2422: Critical severity ORACLE JRE vulnerability
It was discovered that MethodUtil's trampoline class did not properly restrict the invokation of certain methods. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper method-invocation restrictions by the MethodUtil trampoline class, which allows remote attackers to bypass the Java sandbox.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2422?
CVE-2013-2422 is classified as a critical vulnerability, as it allows untrusted Java applications to bypass the Java sandbox restrictions.
How do I fix CVE-2013-2422?
To fix CVE-2013-2422, update to the recommended versions of IcedTea6 or JDK/JRE listed in the security advisory.
What applications are affected by CVE-2013-2422?
CVE-2013-2422 affects various versions of Oracle's JRE and JDK, including versions up to 1.7.0_update15 and earlier.
How can I determine if I am vulnerable to CVE-2013-2422?
You can determine your vulnerability to CVE-2013-2422 by checking your installed version of Java against the lists of affected versions.
Are there workarounds for CVE-2013-2422?
There are no known effective workarounds for CVE-2013-2422; updating to a secure version is recommended.