CVE-2013-5907: Input Validation
An insufficient input validation check flaw was found in the ICU Layout Engine's LookupProcessor, which is part of OpenJDK 2D component. A specially crafted font file could cause Java application to crash or execute arbitrary code. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
This fix improves checks added in the fix for CVE-2012-1713 (bug 829361).
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is due to incorrect input validation in LookupProcessor.cpp in the ICU Layout Engine, which allows attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted font file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5907?
CVE-2013-5907 is rated as a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2013-5907?
To fix CVE-2013-5907, update to the latest version of affected packages such as IcedTea versions 2.4.4, 2.3.13, 1.12.8, or 1.13.1.
What applications are affected by CVE-2013-5907?
CVE-2013-5907 affects Java applications that utilize the ICU Layout Engine's LookupProcessor due to insufficient input validation.
Can CVE-2013-5907 cause system crashes?
Yes, CVE-2013-5907 can lead to application crashes when processing specially crafted font files.
Is CVE-2013-5907 specific to any Java versions?
CVE-2013-5907 specifically impacts versions of Oracle JDK and JRE, including updates 55 and 65.