CVSS: 7.6EPSS: 1%CPEs: 22EXPL: 0CVE-2013-0444 – OpenJDK: MethodFinder insufficient checks for cached results (Beans, 7200493)
https://notcve.org/view.php?id=CVE-2013-0444
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient checks for cached results" by the Java Beans MethodFinder, which might allow attackers to access methods that should only be accessible to privileged code. Vulnerabilidad sin especificar en Java Runtime Environment (JRE) de Oracle Java SE v7 hasta la Update v11 que permite ataques remotos que afectan a la confidencialidad, integridad y disponiblidad por vectores desconocidos relacionados con Beans. • http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907218 http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce04db4aba39 http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html http://marc.info/?l=bugtraq&m=136439120408139&w=2 http://marc.info/?l=bugtraq&m=136733161405818&w=2 http://rhn.redhat.com/errata/RHSA-2013-0237.html http://rhn.redhat.com/errata/RHSA-2013-0247.html http://security.gentoo.org/glsa/glsa-201406-32.xml http: •
CVSS: 10.0EPSS: 4%CPEs: 164EXPL: 0CVE-2013-0450 – OpenJDK: RequiredModelMBean missing access control context checks (JMX, 8000537)
https://notcve.org/view.php?id=CVE-2013-0450
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class. Vulnerabilidad sin especificar en Java Runtime Environmet (JRE) de Oracle Java SE v7 hasta Update v11, desde la v6 hasta la Update v38, y desde la v5.0 hasta Update v38 que permite ataques remotos que afectan a la confidencialidad, integridad, y disponibilidad por vectores relacionados con JMX • http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6e0d9f4942af http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html http://marc.info/?l=bugtraq&m=136439120408139&w=2 http://marc.info/?l=bugtraq&m=136570436423916&w=2 http://marc.info/?l=bugtraq&m=136733161405818&w=2 http://rhn. •
CVSS: 10.0EPSS: 7%CPEs: 219EXPL: 0CVE-2013-1481 – Oracle Java PV_ProcessSampleWithSMOD Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-1481
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. Vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Oracle Java SE 6 hasta la actualización 38, 5,0 hasta la actualización 38 y v1.4.2_40 y anteriores permite a atacantes remotos para afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con Sonido. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way the Java sound libraries parse Soundbank files. Due to an signed comparison check, it is possible to cause an out of bound read on an array of function pointers. • http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00034.html http://marc.info/?l=bugtraq&m=136570436423916&w=2 http://marc.info/?l=bugtraq&m=136733161405818&w=2 http://rhn.redhat.com/errata/RHSA-2013-0236.html http://rhn.redhat.com/errata/RHSA-2013-1455.html http://rhn.redhat.com/errata/RHSA-2013-1456.html http://www.kb.cert.org/vuls/id/858729 http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.securityfocus.com/bid& •
CVSS: 10.0EPSS: 5%CPEs: 241EXPL: 0CVE-2013-0442 – OpenJDK: insufficient privilege checking issue (AWT, 7192977)
https://notcve.org/view.php?id=CVE-2013-0442
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox. Vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Oracle Java SE v7 hasta Update 11, v6 hasta Update 38, v5.0 hasta Update 38, y v1.4.2_40 y anteriores permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad mediante vectores relacionados con AWT. • http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=906899 http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6527ae06da69 http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00034.html http://marc.info/?l=bugtraq&m=136439120408139& •
CVSS: 10.0EPSS: 5%CPEs: 164EXPL: 0CVE-2013-0445 – OpenJDK: insufficient privilege checking issue (AWT, 8001057)
https://notcve.org/view.php?id=CVE-2013-0445
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox. Vulnerabilidad no especificada en el componente Java Runtime Enviroment (JRE) en Oracle Java SE v7 hasta Update 11, v6 hasta Update 38, y v5.0 hasta Update 38 permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad mediantes vectores relacionados con AWT. • http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6527ae06da69 http://marc.info/?l=bugtraq&m=136439120408139&w=2 http://marc.info/?l=bugtraq&m=136570436423916&w=2 http://marc.info/?l=bugtraq&m=136733161405818&w=2 http://rhn.redhat.com/errata/RHSA-2013-0236.html http://rhn.redhat.com/errata/RHSA-2013-0237.html http://rhn.redhat.com/errata/RHSA-2013-0245.html h •