CVE-2013-2472: Critical severity ORACLE JRE vulnerability
It was discovered that the ShortBandedRaster class of the 2D component did not properly verify that the data buffer size fits the raster attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ShortBandedRaster size checks" in 2D.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2472?
CVE-2013-2472 has a CVSS base score of 6.4, indicating it is of medium severity.
How do I fix CVE-2013-2472?
To fix CVE-2013-2472, update your Oracle JRE or JDK to the latest available version.
Which versions are affected by CVE-2013-2472?
CVE-2013-2472 affects multiple versions of Oracle JRE and JDK, specifically 1.7.0 through 1.7.0_21.
What impact does CVE-2013-2472 have on Java applications?
CVE-2013-2472 allows untrusted Java applications to bypass sandbox restrictions, potentially leading to unauthorized code execution.
Is there a workaround for CVE-2013-2472?
A workaround for CVE-2013-2472 is to disable Java in the browser or use web applications that do not require Java.