CVE-2013-5804: Medium severity oracle jre vulnerability
It was discovered that javac did not properly ignore certain ignorable characters. An attacker could influence the integrity and confidentiality of a system by providing specially crafted input, which is then used by javadoc to generate API documentation.
Upstream reports that this issue is relevant to uses where javadoc is used to generate documentation for an untrusted source code and have it hosted on a domain not controlled by the author of the source code (the attacker).
Other sources
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, and JRockit R27.7.6 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Javadoc.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5804?
The severity of CVE-2013-5804 is considered moderate, as it could affect the integrity and confidentiality of a system.
How do I fix CVE-2013-5804?
To fix CVE-2013-5804, update your Java Runtime Environment (JRE) to versions 1.6.0-update60 or later, or JDK versions 1.6.0-update-51 or later.
What systems are affected by CVE-2013-5804?
CVE-2013-5804 affects multiple versions of the Oracle Java Runtime Environment (JRE) and the Oracle JDK, particularly those before 1.7.0-update45.
What kind of input is exploited in CVE-2013-5804?
CVE-2013-5804 can be exploited through specially crafted input provided to javac, leading to the generation of insecure API documentation.
Is there a patch for CVE-2013-5804?
Yes, patches for CVE-2013-5804 are included in the updates for affected versions of the JDK and JRE listed in the vulnerability advisory.