CVE-2013-5896: Medium severity oracle java se 7 vulnerability
The default Java security properties configuration did not restrict access to sub-packages of the com.sun.corba.se package. An untrusted Java application or applet could use this flaw to trigger denial of service. This update lists whole com.sun.corba.se package as restricted in the java.security file.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that com.sun.corba.se and its sub-packages are not included on the restricted package list.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5896?
CVE-2013-5896 has been classified as a high-severity vulnerability due to the potential for denial of service through untrusted Java applications.
How do I fix CVE-2013-5896?
To mitigate CVE-2013-5896, users should update to the latest versions of IcedTea or Oracle JDK and JRE as specified in the security advisory.
Which software is affected by CVE-2013-5896?
CVE-2013-5896 affects various outdated versions of IcedTea and Oracle's JDK and JRE.
What type of attack can CVE-2013-5896 facilitate?
CVE-2013-5896 can facilitate denial of service attacks against applications that utilize the vulnerable packages.
Is CVE-2013-5896 still exploitable in recent versions?
No, recent updates to the affected software have restricted access to the vulnerable sub-packages, mitigating the risk.