CVE-2013-2449: Medium severity ORACLE JRE vulnerability
It was discovered that the GnomeFileTypeDetector did not check for read permissions. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to GnomeFileTypeDetector and a missing check for read permissions for a path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2449?
CVE-2013-2449 is considered a moderate severity vulnerability due to the potential for information disclosure.
How do I fix CVE-2013-2449?
To fix CVE-2013-2449, users should update their Oracle Java Runtime Environment (JRE) or Oracle JDK to the latest available version.
What should I do if I am using an affected version related to CVE-2013-2449?
If using an affected version of Oracle JRE or JDK, immediately upgrade to a patched version to mitigate risks associated with CVE-2013-2449.
Can CVE-2013-2449 be exploited remotely?
Yes, CVE-2013-2449 can be exploited remotely by untrusted Java applications or applets to potentially disclose sensitive information.
What are the affected versions of Oracle JRE due to CVE-2013-2449?
The affected versions of Oracle JRE for CVE-2013-2449 include all versions up to and including 1.7.0-update21.