It was discovered that the ByteBandedRaster class of the 2D component did not properly verify that the data buffer size fits the raster attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

It was discovered that the 2D component did not properly verify certain image attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

It was discovered that the ShortBandedRaster class of the 2D component did not properly verify that the data buffer size fits the raster attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

It was discovered that the ImagingLib of the 2D component did not properly process certain byte lookups. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2468). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C

External Reference:

http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html

It was discovered that the 2D component did not properly verify certain image layouts. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2466). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C

External Reference:

http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html

Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the 2D component (CVE-2013-2464). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C

External Reference:

http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html

It was discovered that various parts of the AWT component did not properly perform integer overflow checks. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

It was discovered that the IntegerComponentRaster class did not properly verify that the data buffer size fits the raster attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013.

Common Vulnerabilities and Exposures assigned an identifier CVE-2013-1488 to the following vulnerability:

Oracle Java 7 Update 17, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

References: [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1488 [2] http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 [3] http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ [4] https://twitter.com/thezdi/status/309425888188043264

It was discovered that the 2D component did not properly verify certain image channels. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect availability via unknown vectors related to Hotspot. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "handling of memory allocation errors."

It was discovered that various parts of the Sound component did not implement proper access restrictions. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2442). Upstream has CVSSv2 scored this issue as: 7.5/AV:N/AC:L/Au:N/C:P/I:P/A:P

External Reference:

http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html

It was discovered that the Libraries component contained certain errors related to XML security and the class loader. A remote attacker could possibly exploit this flaw to disclose potentially sensitive information and cause a denial of service.

The SerialJavaObject class of the JDBC component did not properly restrict access to certain class packages. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

It was discovered that an error related to method handles exists in the Libraries component. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2437). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:P/I:N/A:N

External Reference:

http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html

It was discovered that the ObjectOutputStream class did not properly perform certain access checks when handling subclasses. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.

It was discovered that the ObjectStreamClass class did not properly protect against circular references. An untrusted Java application or applet could possibly use this flaw to cause a denial of service.

It was discovered that the Networking component did not properly prevent the local address from being revealed. An untrusted Java application or applet could possibly use this flaw to disclose the local address.

It was discovered that access checks for getEnclosingClass, getEnclosingMethod and getEnclosingConstructor were not performed properly. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.

It was discovered that the AWT component did not properly manage and restrict certain resources related to the processing of fonts. An untrusted Java application or applet could possibly use this flaw to exhaust available resources and cause a denial of service.

It was discovered that the MBeanServer Introspector of the JMX component did not properly verify the package access. An untrusted Java application or applet could possibly use this flaw to bypass intended package restrictions.

It was discovered that CORBA output streams did not properly implement access restrictions. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.