CVE-2013-2465

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 98,8%

Kerentanan Protection Mechanism Failure pada oracle jre, sun jre. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP. Masuk katalog KEV CISA pada 28 Maret 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

Rincian

Terbit di NVD

18 Juni 2013

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-693: Protection Mechanism Failure

EPSS (30 hari)

98,8% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Oracle Java SE Unspecified Vulnerability

Masuk KEV

28 Maret 2022

Tenggat CISA

18 April 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 102 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html advisory vendor
• http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040 patch
• http://www.us-cert.gov/ncas/alerts/TA13-169A advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2465 pemerintah AS
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html mailing list · advisory pihak ketiga
• http://marc.info/?l=bugtraq&m=137545505800971&w=2 mailing list · advisory pihak ketiga
• http://marc.info/?l=bugtraq&m=137545592101387&w=2 mailing list · advisory pihak ketiga
• http://rhn.redhat.com/errata/RHSA-2013-0963.html advisory pihak ketiga
• http://rhn.redhat.com/errata/RHSA-2013-1059.html advisory pihak ketiga
• http://rhn.redhat.com/errata/RHSA-2013-1060.html advisory pihak ketiga
• http://rhn.redhat.com/errata/RHSA-2013-1081.html advisory pihak ketiga
• http://rhn.redhat.com/errata/RHSA-2013-1455.html advisory pihak ketiga
• http://rhn.redhat.com/errata/RHSA-2013-1456.html advisory pihak ketiga
• http://security.gentoo.org/glsa/glsa-201406-32.xml advisory pihak ketiga
• http://www-01.ibm.com/support/docview.wss?uid=swg21642336 advisory pihak ketiga
• http://www.securityfocus.com/bid/60657 broken link · advisory pihak ketiga · vdb entry
• https://access.redhat.com/errata/RHSA-2014:0414 advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/cve-2013-2465-detect-java-vulnerability exploit · advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/cve-2013-2465-mitigate-java-vulnerability exploit · advisory pihak ketiga