It was discovered that the ByteBandedRaster class of the 2D component did not properly verify that the data buffer size fits the raster attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the 2D component did not properly verify certain image attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the ShortBandedRaster class of the 2D component did not properly verify that the data buffer size fits the raster attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the ImagingLib of the 2D component did not properly process certain byte lookups. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2468). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
It was discovered that the 2D component did not properly verify certain image layouts. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2466). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5824). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
It was discovered that the VersionHelper12 class did not properly honor whether or not modifyThreadGroup is restricted. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the 2D component (CVE-2013-5843). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5789). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5787). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the 2D component (CVE-2013-2464). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
It was discovered that ObjectInputStream and ObjectOutputStream serialization handling did not properly perform certain checks. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the checkPackageAccess function of the class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the virtual machine.
It was discovered that the awtgetPixelByte, awtgetPixelShort, awtsetPixelByte, and awtsetPixelShort functions did not properly verify certain raster attributes. A remote attacker could use this flaw to trigger a Java Virtual Machine memory corruption and, possibly, execute arbitrary code with the privileges of the user running the virtual machine.
It was discovered that the CORBA component did not properly check the permissions of RMIConnection stubs built as part of the JDK. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the Java2d Disposer did not properly dispose of resources if an exception occured during the process. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the JPEGImageReader and JPEGImageWriter classes did not properly verify the band size. An untrusted Java application or applet could possibly use this flaw to trigger a Java Virtual Machine memory corruption.
It was discovered that various parts of the AWT component did not properly perform integer overflow checks. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the IntegerComponentRaster class did not properly verify that the data buffer size fits the raster attributes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013.
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions.
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-1488 to the following vulnerability:
Oracle Java 7 Update 17, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.
References: [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1488 [2] http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 [3] http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ [4] https://twitter.com/thezdi/status/309425888188043264
Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
It was discovered that the 2D component did not properly verify certain image channels. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5832). Upstream has CVSSv2 scored this issue as: 9.3/AV:N/AC:M/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
It was discovered that various security and access checks are not properly performed for certain CORBA classes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.