CVE-2013-5772
First published: Mon Oct 14 2013(Updated: )
It was discovered that jhat (Java Heap Analysis Tool) failed to properly escape all data embedded into HTML pages it generates. A specially crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct a Cross-Site Scripting attacks against users view jhat generated pages.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/icedtea | <2.4.3 | 2.4.3 |
| redhat/icedtea | <1.11.14 | 1.11.14 |
| redhat/icedtea | <1.12.7 | 1.12.7 |
| Oracle Java Runtime Environment (JRE) | <=1.6.0 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update22 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update23 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update24 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update25 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update26 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update27 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update29 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update30 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update31 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update32 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update33 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update34 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update35 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update37 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update38 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update39 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update41 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update43 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update45 | |
| Oracle Java Runtime Environment (JRE) | =1.6.0-update51 | |
| Sun JRE | =1.6.0 | |
| Sun JRE | =1.6.0-update_1 | |
| Sun JRE | =1.6.0-update_10 | |
| Sun JRE | =1.6.0-update_11 | |
| Sun JRE | =1.6.0-update_12 | |
| Sun JRE | =1.6.0-update_13 | |
| Sun JRE | =1.6.0-update_14 | |
| Sun JRE | =1.6.0-update_15 | |
| Sun JRE | =1.6.0-update_16 | |
| Sun JRE | =1.6.0-update_17 | |
| Sun JRE | =1.6.0-update_18 | |
| Sun JRE | =1.6.0-update_19 | |
| Sun JRE | =1.6.0-update_2 | |
| Sun JRE | =1.6.0-update_20 | |
| Sun JRE | =1.6.0-update_21 | |
| Sun JRE | =1.6.0-update_3 | |
| Sun JRE | =1.6.0-update_4 | |
| Sun JRE | =1.6.0-update_5 | |
| Sun JRE | =1.6.0-update_6 | |
| Sun JRE | =1.6.0-update_7 | |
| Sun JRE | =1.6.0-update_9 | |
| Oracle JDK 6 | <=1.6.0 | |
| Oracle JDK 6 | =1.6.0-update22 | |
| Oracle JDK 6 | =1.6.0-update23 | |
| Oracle JDK 6 | =1.6.0-update24 | |
| Oracle JDK 6 | =1.6.0-update25 | |
| Oracle JDK 6 | =1.6.0-update26 | |
| Oracle JDK 6 | =1.6.0-update27 | |
| Oracle JDK 6 | =1.6.0-update29 | |
| Oracle JDK 6 | =1.6.0-update30 | |
| Oracle JDK 6 | =1.6.0-update31 | |
| Oracle JDK 6 | =1.6.0-update32 | |
| Oracle JDK 6 | =1.6.0-update33 | |
| Oracle JDK 6 | =1.6.0-update34 | |
| Oracle JDK 6 | =1.6.0-update35 | |
| Oracle JDK 6 | =1.6.0-update37 | |
| Oracle JDK 6 | =1.6.0-update38 | |
| Oracle JDK 6 | =1.6.0-update39 | |
| Oracle JDK 6 | =1.6.0-update41 | |
| Oracle JDK 6 | =1.6.0-update43 | |
| Oracle JDK 6 | =1.6.0-update45 | |
| Oracle JDK 6 | =1.6.0-update51 | |
| Sun JDK | =1.6.0 | |
| Sun JDK | =1.6.0-update_10 | |
| Sun JDK | =1.6.0-update_11 | |
| Sun JDK | =1.6.0-update_12 | |
| Sun JDK | =1.6.0-update_13 | |
| Sun JDK | =1.6.0-update_14 | |
| Sun JDK | =1.6.0-update_15 | |
| Sun JDK | =1.6.0-update_16 | |
| Sun JDK | =1.6.0-update_17 | |
| Sun JDK | =1.6.0-update_18 | |
| Sun JDK | =1.6.0-update_19 | |
| Sun JDK | =1.6.0-update_20 | |
| Sun JDK | =1.6.0-update_21 | |
| Sun JDK | =1.6.0-update_3 | |
| Sun JDK | =1.6.0-update_4 | |
| Sun JDK | =1.6.0-update_5 | |
| Sun JDK | =1.6.0-update_6 | |
| Sun JDK | =1.6.0-update_7 | |
| Sun JDK | =1.6.0-update1 | |
| Sun JDK | =1.6.0-update1_b06 | |
| Sun JDK | =1.6.0-update2 | |
| Oracle Java Runtime Environment (JRE) | <=1.7.0 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update1 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update10 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update11 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update13 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update15 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update17 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update2 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update21 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update25 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update3 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update4 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update5 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update6 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update7 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update9 | |
| Oracle JDK 6 | <=1.7.0 | |
| Oracle JDK 6 | =1.7.0 | |
| Oracle JDK 6 | =1.7.0-update1 | |
| Oracle JDK 6 | =1.7.0-update10 | |
| Oracle JDK 6 | =1.7.0-update11 | |
| Oracle JDK 6 | =1.7.0-update13 | |
| Oracle JDK 6 | =1.7.0-update15 | |
| Oracle JDK 6 | =1.7.0-update17 | |
| Oracle JDK 6 | =1.7.0-update2 | |
| Oracle JDK 6 | =1.7.0-update21 | |
| Oracle JDK 6 | =1.7.0-update25 | |
| Oracle JDK 6 | =1.7.0-update3 | |
| Oracle JDK 6 | =1.7.0-update4 | |
| Oracle JDK 6 | =1.7.0-update5 | |
| Oracle JDK 6 | =1.7.0-update6 | |
| Oracle JDK 6 | =1.7.0-update7 | |
| Oracle JDK 6 | =1.7.0-update9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00023.html
- http://marc.info/?l=bugtraq&m=138674031212883&w=2
- http://marc.info/?l=bugtraq&m=138674073720143&w=2
- http://rhn.redhat.com/errata/RHSA-2013-1440.html
- http://rhn.redhat.com/errata/RHSA-2013-1447.html
- http://rhn.redhat.com/errata/RHSA-2013-1451.html
- http://rhn.redhat.com/errata/RHSA-2013-1505.html
- http://rhn.redhat.com/errata/RHSA-2013-1507.html
- http://rhn.redhat.com/errata/RHSA-2013-1508.html
- http://rhn.redhat.com/errata/RHSA-2013-1793.html
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://support.apple.com/kb/HT5982
- http://www-01.ibm.com/support/docview.wss?uid=swg21655201
- http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
- http://www.securityfocus.com/bid/63089
- http://www.ubuntu.com/usn/USN-2033-1
- http://www.ubuntu.com/usn/USN-2089-1
- https://access.redhat.com/errata/RHSA-2014:0414
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19219
- http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/85226f84bc29
- https://rhn.redhat.com/errata/RHSA-2013-1440.html
- https://rhn.redhat.com/errata/RHSA-2013-1447.html
- https://rhn.redhat.com/errata/RHSA-2013-1451.html
- https://rhn.redhat.com/errata/RHSA-2013-1505.html
- https://rhn.redhat.com/errata/RHSA-2013-1508.html
- https://rhn.redhat.com/errata/RHSA-2013-1507.html
- https://rhn.redhat.com/errata/RHSA-2013-1793.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-October/025087.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-November/025278.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-November/025328.html
- https://rhn.redhat.com/errata/RHSA-2014-0414.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1018717
- agent/type
- agent/first-publish-date
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-5772
- agent/software-canonical-lookup
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/oracle
- canonical/oracle java runtime environment (jre)
- version/oracle java runtime environment (jre)/1.6.0
- version/oracle java runtime environment (jre)/1.6.0-update22
- version/oracle java runtime environment (jre)/1.6.0-update23
- version/oracle java runtime environment (jre)/1.6.0-update24
- version/oracle java runtime environment (jre)/1.6.0-update25
- version/oracle java runtime environment (jre)/1.6.0-update26
- version/oracle java runtime environment (jre)/1.6.0-update27
- version/oracle java runtime environment (jre)/1.6.0-update29
- version/oracle java runtime environment (jre)/1.6.0-update30
- version/oracle java runtime environment (jre)/1.6.0-update31
- version/oracle java runtime environment (jre)/1.6.0-update32
- version/oracle java runtime environment (jre)/1.6.0-update33
- version/oracle java runtime environment (jre)/1.6.0-update34
- version/oracle java runtime environment (jre)/1.6.0-update35
- version/oracle java runtime environment (jre)/1.6.0-update37
- version/oracle java runtime environment (jre)/1.6.0-update38
- version/oracle java runtime environment (jre)/1.6.0-update39
- version/oracle java runtime environment (jre)/1.6.0-update41
- version/oracle java runtime environment (jre)/1.6.0-update43
- version/oracle java runtime environment (jre)/1.6.0-update45
- version/oracle java runtime environment (jre)/1.6.0-update51
- vendor/sun
- canonical/sun jre
- version/sun jre/1.6.0
- version/sun jre/1.6.0-update_1
- version/sun jre/1.6.0-update_10
- version/sun jre/1.6.0-update_11
- version/sun jre/1.6.0-update_12
- version/sun jre/1.6.0-update_13
- version/sun jre/1.6.0-update_14
- version/sun jre/1.6.0-update_15
- version/sun jre/1.6.0-update_16
- version/sun jre/1.6.0-update_17
- version/sun jre/1.6.0-update_18
- version/sun jre/1.6.0-update_19
- version/sun jre/1.6.0-update_2
- version/sun jre/1.6.0-update_20
- version/sun jre/1.6.0-update_21
- version/sun jre/1.6.0-update_3
- version/sun jre/1.6.0-update_4
- version/sun jre/1.6.0-update_5
- version/sun jre/1.6.0-update_6
- version/sun jre/1.6.0-update_7
- version/sun jre/1.6.0-update_9
- canonical/oracle jdk 6
- version/oracle jdk 6/1.6.0
- version/oracle jdk 6/1.6.0-update22
- version/oracle jdk 6/1.6.0-update23
- version/oracle jdk 6/1.6.0-update24
- version/oracle jdk 6/1.6.0-update25
- version/oracle jdk 6/1.6.0-update26
- version/oracle jdk 6/1.6.0-update27
- version/oracle jdk 6/1.6.0-update29
- version/oracle jdk 6/1.6.0-update30
- version/oracle jdk 6/1.6.0-update31
- version/oracle jdk 6/1.6.0-update32
- version/oracle jdk 6/1.6.0-update33
- version/oracle jdk 6/1.6.0-update34
- version/oracle jdk 6/1.6.0-update35
- version/oracle jdk 6/1.6.0-update37
- version/oracle jdk 6/1.6.0-update38
- version/oracle jdk 6/1.6.0-update39
- version/oracle jdk 6/1.6.0-update41
- version/oracle jdk 6/1.6.0-update43
- version/oracle jdk 6/1.6.0-update45
- version/oracle jdk 6/1.6.0-update51
- canonical/sun jdk
- version/sun jdk/1.6.0
- version/sun jdk/1.6.0-update_10
- version/sun jdk/1.6.0-update_11
- version/sun jdk/1.6.0-update_12
- version/sun jdk/1.6.0-update_13
- version/sun jdk/1.6.0-update_14
- version/sun jdk/1.6.0-update_15
- version/sun jdk/1.6.0-update_16
- version/sun jdk/1.6.0-update_17
- version/sun jdk/1.6.0-update_18
- version/sun jdk/1.6.0-update_19
- version/sun jdk/1.6.0-update_20
- version/sun jdk/1.6.0-update_21
- version/sun jdk/1.6.0-update_3
- version/sun jdk/1.6.0-update_4
- version/sun jdk/1.6.0-update_5
- version/sun jdk/1.6.0-update_6
- version/sun jdk/1.6.0-update_7
- version/sun jdk/1.6.0-update1
- version/sun jdk/1.6.0-update1_b06
- version/sun jdk/1.6.0-update2
- version/oracle java runtime environment (jre)/1.7.0
- version/oracle java runtime environment (jre)/1.7.0-update1
- version/oracle java runtime environment (jre)/1.7.0-update10
- version/oracle java runtime environment (jre)/1.7.0-update11
- version/oracle java runtime environment (jre)/1.7.0-update13
- version/oracle java runtime environment (jre)/1.7.0-update15
- version/oracle java runtime environment (jre)/1.7.0-update17
- version/oracle java runtime environment (jre)/1.7.0-update2
- version/oracle java runtime environment (jre)/1.7.0-update21
- version/oracle java runtime environment (jre)/1.7.0-update25
- version/oracle java runtime environment (jre)/1.7.0-update3
- version/oracle java runtime environment (jre)/1.7.0-update4
- version/oracle java runtime environment (jre)/1.7.0-update5
- version/oracle java runtime environment (jre)/1.7.0-update6
- version/oracle java runtime environment (jre)/1.7.0-update7
- version/oracle java runtime environment (jre)/1.7.0-update9
- version/oracle jdk 6/1.7.0
- version/oracle jdk 6/1.7.0-update1
- version/oracle jdk 6/1.7.0-update10
- version/oracle jdk 6/1.7.0-update11
- version/oracle jdk 6/1.7.0-update13
- version/oracle jdk 6/1.7.0-update15
- version/oracle jdk 6/1.7.0-update17
- version/oracle jdk 6/1.7.0-update2
- version/oracle jdk 6/1.7.0-update21
- version/oracle jdk 6/1.7.0-update25
- version/oracle jdk 6/1.7.0-update3
- version/oracle jdk 6/1.7.0-update4
- version/oracle jdk 6/1.7.0-update5
- version/oracle jdk 6/1.7.0-update6
- version/oracle jdk 6/1.7.0-update7
- version/oracle jdk 6/1.7.0-update9