CVSS: 10.0EPSS: 4%CPEs: 37EXPL: 0CVE-2013-2434 – Oracle Java t2k.dll glyph_AddPoint() Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-2434
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Vulnerabilidad no especificada en el entorno de ejecución de Java (JRE) en el componente Oracle Java SE v7 Update v17 y anteriores y JavaFX v2.2.7 y anteriores permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con 2D. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t2k.dll glyph_AddPoint() when rendering Type1 or Type2 fonts. Memory corruption could occur when manipulating a point count in the font file. • http://marc.info/?l=bugtraq&m=137283787217316&w=2 http://rhn.redhat.com/errata/RHSA-2013-0757.html http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html http://www.us-cert.gov/ncas/alerts/TA13-107A https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16201 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19462 https://access.redhat.com/security/cve/CVE-2013-2434 https://bugzilla.redhat.com/s •
CVSS: 6.9EPSS: 0%CPEs: 189EXPL: 0CVE-2013-2439 – JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Install)
https://notcve.org/view.php?id=CVE-2013-2439
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install. Vulnerabilidad no especificada en el entorno de ejecución de Java (JRE) en el componente Oracle Java SE v7 Update v17 y anteriores, v6 Update v43 y anteriores, v5.0 Update v41 y anteriores, y JavaFX v2.2.7 y anteriores permite a usuarios locales afectar a la confidencialidad, integridad y la disponibilidad a través de vectores desconocidos relacionados con la instalación. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880 http://marc.info/?l=bugtraq&m=137283787217316&w=2 http://rhn.redhat.com/errata/RHSA-2013-0757.html http://rhn.redhat.com/errata/RHSA-2013-0758.html http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html http://www.securityfocus.com/bid/59178 http://www.us-cert.gov/ncas/alerts/TA13-107A https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19473 https&# •
CVSS: 10.0EPSS: 28%CPEs: 3EXPL: 0CVE-2013-0402 – Oracle Java FLV Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-0402
Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013. Un desbordamiento de búfer basado en memoria dinámica ('heap') en Oracle Java 7 Update v17 y posiblemente otras versiones, permite a atacantes remotos ejecutar código de su elección a través de vectores no especificados, como fue demostrado por VUPEN durante el concurso Pwn2Own en CanSecWest 2013. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of FLV files. The issue lies in the parsing of a FLV file with two video tags using the On2 VP6 codec. • http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 http://rhn.redhat.com/errata/RHSA-2013-0757.html http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html http://www.us-cert.gov/ncas/alerts/TA13-107A http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15728 https://twitter.com/thezdi/status/309484730506698752 https://access.redhat.com/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 1%CPEs: 7EXPL: 0CVE-2013-1477
https://notcve.org/view.php?id=CVE-2013-1477
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU. Vulnerabilidad no especificada en el componente JavaFX en Oracle Java SE JavaFX v2.2.4 y anteriores permite a atacantes remotos afectar a la confidencialidad, integridad y disponibilidad mediante vectores desconocidos, una vulnerabilidad diferente a otros CVEs listados en el February 2013 CPU. • http://marc.info/?l=bugtraq&m=136733161405818&w=2 http://www.kb.cert.org/vuls/id/858729 http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.us-cert.gov/cas/techalerts/TA13-032A.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16657 •
CVSS: 9.3EPSS: 1%CPEs: 7EXPL: 0CVE-2013-1474
https://notcve.org/view.php?id=CVE-2013-1474
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU. Vulnerabilidad sin especificar en JavaFx de Oracle Java SE JavaFX v2.2.4 y anteriores que permite ataques remotos que afectan a la confidencialidad, integridad y disponibilidad por vectores sin especificar. Esta vulnerabilidad es diferente a otras listadas en febrero de 2013. • http://marc.info/?l=bugtraq&m=136733161405818&w=2 http://www.kb.cert.org/vuls/id/858729 http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.us-cert.gov/cas/techalerts/TA13-032A.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16378 •