CVE Feed

    Dashboard / CVE / CVE-2013-2465

    CVE-2013-2465

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

    Published:Jun 18, 2013
    Last Modified:Apr 22, 2026
    EPS:Jun 18, 2013
    EPSS Score:0.9322
    CVSS Score:9.8

    CISA Notification

    Description

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

    Required Action:

    Apply updates per vendor instructions.

    Notes:

    No extra notes provided.

    Due Date
    Apr 18, 2022
    1607 days ago
    Alert Date
    Mar 28, 2022
    1628 days ago

    Affected Products

    Vendor
    Oracle
    Product
    Jre
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Network Satellite
    Vendor
    Redhat
    Product
    Rhel Extras
    Vendor
    Redhat
    Product
    Rhel Extras Oracle Java
    Vendor
    Sun
    Product
    Jre
    Vendor
    Suse
    Product
    Linux Enterprise Desktop
    Vendor
    Suse
    Product
    Linux Enterprise Java
    Vendor
    Suse
    Product
    Linux Enterprise Server
    Vendor
    Suse
    Product
    Linux Enterprise Software Development Kit

    Exploits

    https://www.vicarius.io/vsociety/posts/cve-2013-2465-detect-java-vulnerabilityhttps://www.vicarius.io/vsociety/posts/cve-2013-2465-mitigate-java-vulnerabilityhttps://www.exploit-db.com/exploits/27705

    Common Weakness Enumeration

    CWE-693 Protection Mechanism Failure

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
    CAPEC-107 Cross Site Tracing
    CAPEC-127 Directory Indexing
    CAPEC-17 Using Malicious Files
    CAPEC-20 Encryption Brute Forcing
    CAPEC-22 Exploiting Trust in Client
    CAPEC-237 Escaping a Sandbox by Calling Code in Another Language
    CAPEC-36 Using Unpublished Interfaces or Functionality
    CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content
    CAPEC-480 Escaping Virtualization
    CAPEC-51 Poison Web Service Registry
    CAPEC-57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
    CAPEC-59 Session Credential Falsification through Prediction
    CAPEC-65 Sniff Application Code
    CAPEC-668 Key Negotiation of Bluetooth Attack (KNOB)
    CAPEC-74 Manipulating State
    CAPEC-87 Forceful Browsing

    Related CVEs

    CVE-2026-62574 (CVSS 7.8) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2026-47013 (CVSS 5.3) — Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java S…
    CVE-2026-47021 (CVSS 5.3) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2026-22003 (CVSS 6) — Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: H…
    CVE-2026-34268 (CVSS 2.9) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2026-22018 (CVSS 3.7) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2026-22013 (CVSS 5.3) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2026-34282 (CVSS 7.5) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2026-22021 (CVSS 5.3) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2026-22007 (CVSS 2.9) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…

    References

    http://advisories.mageia.org/MGASA-2013-0185.html
    http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880
    http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html
    http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html
    http://marc.info/?l=bugtraq&m=137545505800971&w=2
    http://marc.info/?l=bugtraq&m=137545592101387&w=2
    http://rhn.redhat.com/errata/RHSA-2013-0963.html
    http://rhn.redhat.com/errata/RHSA-2013-1059.html
    http://rhn.redhat.com/errata/RHSA-2013-1060.html
    http://rhn.redhat.com/errata/RHSA-2013-1081.html
    http://rhn.redhat.com/errata/RHSA-2013-1455.html
    http://rhn.redhat.com/errata/RHSA-2013-1456.html
    http://secunia.com/advisories/54154
    http://security.gentoo.org/glsa/glsa-201406-32.xml
    http://www-01.ibm.com/support/docview.wss?uid=swg21642336
    http://www.mandriva.com/security/advisories?name=MDVSA-2013:183
    http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
    http://www.securityfocus.com/bid/60657
    http://www.us-cert.gov/ncas/alerts/TA13-169A
    https://access.redhat.com/errata/RHSA-2014:0414
    https://bugzilla.redhat.com/show_bug.cgi?id=975118
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17106
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19074
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19455
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19703
    http://advisories.mageia.org/MGASA-2013-0185.html
    http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880
    http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html
    http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html
    http://marc.info/?l=bugtraq&m=137545505800971&w=2
    http://marc.info/?l=bugtraq&m=137545592101387&w=2
    http://rhn.redhat.com/errata/RHSA-2013-0963.html
    http://rhn.redhat.com/errata/RHSA-2013-1059.html
    http://rhn.redhat.com/errata/RHSA-2013-1060.html
    http://rhn.redhat.com/errata/RHSA-2013-1081.html
    http://rhn.redhat.com/errata/RHSA-2013-1455.html
    http://rhn.redhat.com/errata/RHSA-2013-1456.html
    http://secunia.com/advisories/54154
    http://security.gentoo.org/glsa/glsa-201406-32.xml
    http://www-01.ibm.com/support/docview.wss?uid=swg21642336
    http://www.mandriva.com/security/advisories?name=MDVSA-2013:183
    http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
    http://www.securityfocus.com/bid/60657
    http://www.us-cert.gov/ncas/alerts/TA13-169A
    https://access.redhat.com/errata/RHSA-2014:0414
    https://bugzilla.redhat.com/show_bug.cgi?id=975118
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17106
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19074
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19455
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19703
    https://www.vicarius.io/vsociety/posts/cve-2013-2465-detect-java-vulnerability
    https://www.vicarius.io/vsociety/posts/cve-2013-2465-mitigate-java-vulnerability
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2465

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High