CVE-2013-5878: High severity oracle java se 7 vulnerability
A flaw found in the way Security component in OpenJDK handled null xmlns (XML namespace) attributes when performing XML document canonicalization. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the Security component does not properly handle null XML namespace (xmlns) attributes during XML document canonicalization, which allows attackers to escape the sandbox.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5878?
CVE-2013-5878 is classified as a moderate severity vulnerability.
How do I fix CVE-2013-5878?
To fix CVE-2013-5878, upgrade to versions of IcedTea greater than 2.4.4 or Oracle JDK/JRE greater than 1.6.0-update65.
What causes CVE-2013-5878?
CVE-2013-5878 is caused by improper handling of null XML namespace attributes in OpenJDK during XML canonicalization.
What are the affected versions for CVE-2013-5878?
Affected versions for CVE-2013-5878 include IcedTea versions up to 2.4.4 and Oracle JDK/JRE versions up to 1.6.0-update65.
Can CVE-2013-5878 be exploited remotely?
Yes, CVE-2013-5878 can potentially be exploited by an untrusted application or applet to bypass Java sandbox restrictions.