It was discovered that the ByteBandedRaster class of the 2D component did not properly verify that the data buffer size fits the raster attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the 2D component did not properly verify certain image attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the ShortBandedRaster class of the 2D component did not properly verify that the data buffer size fits the raster attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the ImagingLib of the 2D component did not properly process certain byte lookups. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2468). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
It was discovered that the 2D component did not properly verify certain image layouts. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2466). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
Multiple flaws were discovered in the native code implementing fontmanager layout lookup operations. A specially-crafted font file could cause Java Virtual Machine to crash or corrupt its memory, possibly allowing code execution with the virtual machine privileges.
Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the 2D component (CVE-2013-2464). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
It was discovered that various parts of the AWT component did not properly perform integer overflow checks. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the IntegerComponentRaster class did not properly verify that the data buffer size fits the raster attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1721.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1722.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier and 6 Update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-3159.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.238 and earlier; and JavaFX 2.2 and earlier; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
It was discovered that the CMM part of the 2D component did not properly reject certain malformed images. Specially-crafted raster parameters could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the virtual machine privileges.
It was discovered that the JAXP component lacked certain security restrictions. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the 2D component contained multiple errors within the font layout and font glyph table processing. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. As the provided patch combined fixes for CVE-2013-2383, CVE-2013-2384 and CVE-2013-1569, it is currently not possible to match individual issues to their respective CVE identifier.
It was discovered that LogStream.setDefaultStream() is missing security restrictions. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2440.
RMI implementation in OpenJDK uses property java.rmi.server.useCodebaseOnly, which controls whether automatic loading of classes from other sources than local CLASSPATH and location specified in the java.rmi.server.codebase property is permitted. This property previously defaulted to false, allowing dynamic class downloading. This could allow an attacker to make RMI server or registry to execute arbitrary untrusted code.
It was demonstrated that this can be used in combination with another Java sandbox bypass flaw to execute code in the remote rmiregistry or GlassFish Server:
http://seclists.org/fulldisclosure/2013/Feb/18 http://www.security-explorations.com/en/SE-2012-01-details.html http://www.security-explorations.com/materials/se-2012-01-rmi.zip
This update changes the default value of the java.rmi.server.useCodebaseOnly property to true.
More details on various RMI properties can be found in:
http://docs.oracle.com/javase/7/docs/technotes/guides/rmi/javarmiproperties.html
It was discovered that the 2D component contained multiple errors within the font layout and font glyph table processing. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. As the provided patch combined fixes for CVE-2013-2383, CVE-2013-2384 and CVE-2013-1569, it is currently not possible to match individual issues to their respective CVE identifier.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-2394 and CVE-2013-1491.
It was discovered that the 2D component did not properly process certain images. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that MethodUtil's trampoline class did not properly restrict the invokation of certain methods. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2435.