CVE-2013-5910: Medium severity oracle java se 7 vulnerability
It was discovered that the Security component in OpenJDK could pass mutable strings to untrusted code. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Security. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that CanonicalizerBase.java in the XML canonicalizer allows untrusted code to access mutable byte arrays.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5910?
CVE-2013-5910 has been rated as a high-severity vulnerability that can allow bypassing Java sandbox restrictions.
How do I fix CVE-2013-5910?
To fix CVE-2013-5910, you should upgrade to the latest patched versions of OpenJDK or IcedTea as specified by the vendor.
What software is affected by CVE-2013-5910?
CVE-2013-5910 affects various versions of Oracle JDK and JRE, specifically 6u65 and 7u45, along with multiple versions of IcedTea.
What are the potential impacts of CVE-2013-5910?
The potential impact of CVE-2013-5910 includes the ability for untrusted Java applications to execute code outside of the controlled sandbox environment.
Is there a workaround for CVE-2013-5910?
There are no effective workarounds for CVE-2013-5910; upgrading to a secure version is the most reliable mitigation.