CVE-2013-2461
First published: Mon Jun 17 2013(Updated: )
It was discovered that the DOMCanonicalizationMethod did not properly verify the canonicalization algorithm. A remote attacker could possibly exploit this flaw to bypass correct XML signature verification.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle JDK | =1.6.0-update22 | |
| Oracle JDK | =1.6.0-update23 | |
| Oracle JDK | =1.6.0-update24 | |
| Oracle JDK | =1.6.0-update25 | |
| Oracle JDK | =1.6.0-update26 | |
| Oracle JDK | =1.6.0-update27 | |
| Oracle JDK | =1.6.0-update29 | |
| Oracle JDK | =1.6.0-update30 | |
| Oracle JDK | =1.6.0-update31 | |
| Oracle JDK | =1.6.0-update32 | |
| Oracle JDK | =1.6.0-update33 | |
| Oracle JDK | =1.6.0-update34 | |
| Oracle JDK | =1.6.0-update35 | |
| Oracle JDK | =1.6.0-update37 | |
| Oracle JDK | =1.6.0-update38 | |
| Oracle JDK | =1.6.0-update39 | |
| Oracle JDK | =1.6.0-update41 | |
| Oracle JDK | =1.6.0-update43 | |
| Sun JDK | =1.6.0 | |
| Sun JDK | =1.6.0-update_10 | |
| Sun JDK | =1.6.0-update_11 | |
| Sun JDK | =1.6.0-update_12 | |
| Sun JDK | =1.6.0-update_13 | |
| Sun JDK | =1.6.0-update_14 | |
| Sun JDK | =1.6.0-update_15 | |
| Sun JDK | =1.6.0-update_16 | |
| Sun JDK | =1.6.0-update_17 | |
| Sun JDK | =1.6.0-update_18 | |
| Sun JDK | =1.6.0-update_19 | |
| Sun JDK | =1.6.0-update_20 | |
| Sun JDK | =1.6.0-update_21 | |
| Sun JDK | =1.6.0-update_3 | |
| Sun JDK | =1.6.0-update_4 | |
| Sun JDK | =1.6.0-update_5 | |
| Sun JDK | =1.6.0-update_6 | |
| Sun JDK | =1.6.0-update_7 | |
| Sun JDK | =1.6.0-update1 | |
| Sun JDK | =1.6.0-update1_b06 | |
| Sun JDK | =1.6.0-update2 | |
| Oracle JRE | =1.7.0 | |
| Oracle JRE | =1.7.0-update1 | |
| Oracle JRE | =1.7.0-update10 | |
| Oracle JRE | =1.7.0-update11 | |
| Oracle JRE | =1.7.0-update13 | |
| Oracle JRE | =1.7.0-update15 | |
| Oracle JRE | =1.7.0-update17 | |
| Oracle JRE | =1.7.0-update2 | |
| Oracle JRE | =1.7.0-update3 | |
| Oracle JRE | =1.7.0-update4 | |
| Oracle JRE | =1.7.0-update5 | |
| Oracle JRE | =1.7.0-update6 | |
| Oracle JRE | =1.7.0-update7 | |
| Oracle JRE | =1.7.0-update9 | |
| Oracle JRockit | >=r27.7.1<=r27.7.5 | |
| Oracle JRockit | >=r28.0.0<=r28.2.7 | |
| Oracle OpenJDK | =1.7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
- https://rhn.redhat.com/errata/RHSA-2013-0958.html
- https://rhn.redhat.com/errata/RHSA-2013-0957.html
- http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/abe9ea5a50d2
- https://rhn.redhat.com/errata/RHSA-2013-0963.html
- https://rhn.redhat.com/errata/RHSA-2013-1014.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-July/023941.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-June/023849.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-June/023860.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-July/023895.html
- https://rhn.redhat.com/errata/RHSA-2014-0414.html
- https://bugzilla.redhat.com/show_bug.cgi?id=975126
- http://advisories.mageia.org/MGASA-2013-0185.html
- http://marc.info/?l=bugtraq&m=137545505800971&w=2
- http://marc.info/?l=bugtraq&m=137545592101387&w=2
- http://rhn.redhat.com/errata/RHSA-2013-0963.html
- http://seclists.org/fulldisclosure/2014/Dec/23
- http://secunia.com/advisories/54154
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:183
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
- http://www.securityfocus.com/archive/1/534161/100/0/threaded
- http://www.securityfocus.com/bid/60645
- http://www.us-cert.gov/ncas/alerts/TA13-169A
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- https://access.redhat.com/errata/RHSA-2014:0414
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16887
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19565
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19582
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-2461
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/oracle jdk
- version/oracle jdk/1.6.0-update22
- version/oracle jdk/1.6.0-update23
- version/oracle jdk/1.6.0-update24
- version/oracle jdk/1.6.0-update25
- version/oracle jdk/1.6.0-update26
- version/oracle jdk/1.6.0-update27
- version/oracle jdk/1.6.0-update29
- version/oracle jdk/1.6.0-update30
- version/oracle jdk/1.6.0-update31
- version/oracle jdk/1.6.0-update32
- version/oracle jdk/1.6.0-update33
- version/oracle jdk/1.6.0-update34
- version/oracle jdk/1.6.0-update35
- version/oracle jdk/1.6.0-update37
- version/oracle jdk/1.6.0-update38
- version/oracle jdk/1.6.0-update39
- version/oracle jdk/1.6.0-update41
- version/oracle jdk/1.6.0-update43
- vendor/sun
- canonical/sun jdk
- version/sun jdk/1.6.0
- version/sun jdk/1.6.0-update_10
- version/sun jdk/1.6.0-update_11
- version/sun jdk/1.6.0-update_12
- version/sun jdk/1.6.0-update_13
- version/sun jdk/1.6.0-update_14
- version/sun jdk/1.6.0-update_15
- version/sun jdk/1.6.0-update_16
- version/sun jdk/1.6.0-update_17
- version/sun jdk/1.6.0-update_18
- version/sun jdk/1.6.0-update_19
- version/sun jdk/1.6.0-update_20
- version/sun jdk/1.6.0-update_21
- version/sun jdk/1.6.0-update_3
- version/sun jdk/1.6.0-update_4
- version/sun jdk/1.6.0-update_5
- version/sun jdk/1.6.0-update_6
- version/sun jdk/1.6.0-update_7
- version/sun jdk/1.6.0-update1
- version/sun jdk/1.6.0-update1_b06
- version/sun jdk/1.6.0-update2
- canonical/oracle jre
- version/oracle jre/1.7.0
- version/oracle jre/1.7.0-update1
- version/oracle jre/1.7.0-update10
- version/oracle jre/1.7.0-update11
- version/oracle jre/1.7.0-update13
- version/oracle jre/1.7.0-update15
- version/oracle jre/1.7.0-update17
- version/oracle jre/1.7.0-update2
- version/oracle jre/1.7.0-update3
- version/oracle jre/1.7.0-update4
- version/oracle jre/1.7.0-update5
- version/oracle jre/1.7.0-update6
- version/oracle jre/1.7.0-update7
- version/oracle jre/1.7.0-update9
- canonical/oracle jrockit
- version/oracle jrockit/r27.7.1
- version/oracle jrockit/r27.7.5
- version/oracle jrockit/r28.0.0
- version/oracle jrockit/r28.2.7
- canonical/oracle openjdk
- version/oracle openjdk/1.7.0