CVE-2013-5457
First published: Tue Nov 05 2013(Updated: )
An unspecified Java sandbox bypass issue in the ORB component was fixed in IBM JDK 7 SR6 and 6 SR15. This issue got the following CVSSv2 score upstream: 9.3/AV:N/AC:M/Au:N/C:C/I:C/A:C <a href="https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013">https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013</a> <a href="https://www.ibm.com/developerworks/java/jdk/aix/j732/Java7.fixes.html#SR6">https://www.ibm.com/developerworks/java/jdk/aix/j732/Java7.fixes.html#SR6</a> <a href="https://www.ibm.com/developerworks/java/jdk/aix/j632/Java6.fixes.html#SR15">https://www.ibm.com/developerworks/java/jdk/aix/j632/Java6.fixes.html#SR15</a> Further info is available in this WebSphere Real Time security bulletin: <a href="http://www-01.ibm.com/support/docview.wss?uid=swg21655202&myns=swgws&mynp=OCSSSTCZ&mync=R">http://www-01.ibm.com/support/docview.wss?uid=swg21655202&myns=swgws&mynp=OCSSSTCZ&mync=R</a> <a href="https://access.redhat.com/security/cve/CVE-2013-5456">CVE-2013-5456</a>, <a href="https://access.redhat.com/security/cve/CVE-2013-5457">CVE-2013-5457</a> and <a href="https://access.redhat.com/security/cve/CVE-2013-5458">CVE-2013-5458</a> allow code running under a security manager to escalate its privileges by modifying or removing the security manager. Additional details may become available under this X-Force database article: <a href="http://xforce.iss.net/xforce/xfdb/88256">http://xforce.iss.net/xforce/xfdb/88256</a>
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <1.6.0-ibm-1:1.6.0.15.0-1jpp.1.el5 | 1.6.0-ibm-1:1.6.0.15.0-1jpp.1.el5 |
| redhat/java | <1.7.0-ibm-1:1.7.0.6.0-1jpp.1.el5_10 | 1.7.0-ibm-1:1.7.0.6.0-1jpp.1.el5_10 |
| redhat/java | <1.6.0-ibm-1:1.6.0.15.0-1jpp.1.el5_10 | 1.6.0-ibm-1:1.6.0.15.0-1jpp.1.el5_10 |
| redhat/java | <1.7.0-ibm-1:1.7.0.6.0-1jpp.1.el6_4 | 1.7.0-ibm-1:1.7.0.6.0-1jpp.1.el6_4 |
| redhat/java | <1.6.0-ibm-1:1.6.0.15.0-1jpp.1.el6_4 | 1.6.0-ibm-1:1.6.0.15.0-1jpp.1.el6_4 |
| IBM JDK | =6.0.0.0 | |
| IBM JDK | =6.0.1.0 | |
| IBM JDK | =7.0.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013
- https://www.ibm.com/developerworks/java/jdk/aix/j732/Java7.fixes.html#SR6
- https://www.ibm.com/developerworks/java/jdk/aix/j632/Java6.fixes.html#SR15
- http://www-01.ibm.com/support/docview.wss?uid=swg21655202&myns=swgws&mynp=OCSSSTCZ&mync=R
- https://access.redhat.com/security/cve/CVE-2013-5456
- https://access.redhat.com/security/cve/CVE-2013-5457
- https://access.redhat.com/security/cve/CVE-2013-5458
- http://xforce.iss.net/xforce/xfdb/88256
- https://rhn.redhat.com/errata/RHSA-2013-1508.html
- https://rhn.redhat.com/errata/RHSA-2013-1507.html
- https://rhn.redhat.com/errata/RHSA-2013-1793.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1027760
- https://www.cve.org/CVERecord?id=CVE-2013-5457 https://nvd.nist.gov/vuln/detail/CVE-2013-5457
- https://access.redhat.com/errata/RHSA-2013:1793
- https://access.redhat.com/errata/RHSA-2013:1507
- https://access.redhat.com/errata/RHSA-2013:1508
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html
- http://rhn.redhat.com/errata/RHSA-2013-1507.html
- http://rhn.redhat.com/errata/RHSA-2013-1508.html
- http://rhn.redhat.com/errata/RHSA-2013-1793.html
- http://secunia.com/advisories/56338
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV51334
- http://www-01.ibm.com/support/docview.wss?uid=swg21655201
- http://www-01.ibm.com/support/docview.wss?uid=swg21655202
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88256
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-bugzilla
- alias/CVE-2013-5457
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/author
- agent/last-modified-date
- agent/event
- agent/description
- agent/trending
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- agent/source
- package-manager/redhat
- vendor/ibm
- canonical/ibm jdk
- version/ibm jdk/6.0.0.0
- version/ibm jdk/6.0.1.0
- version/ibm jdk/7.0.0.0