CVSS: 7.5EPSS: 10%CPEs: 1EXPL: 0CVE-2013-2549 – Adobe Reader Sandbox Bypass Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-2549
Unspecified vulnerability in Adobe Reader 11.0.02 allows remote attackers to execute arbitrary code via vectors related to a "break into the sandbox," as demonstrated by George Hotz during a Pwn2Own competition at CanSecWest 2013. Vulnerabilidad no especificada en Adobe Reader v11.0.02 permite a atacantes remotos ejecutar código de su elección a través de vectores relacionados con "break into the sandbox", como demostró George Hotz durante la competición Pwn2Own en CanSecWest 2013. • http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00004.html http://rhn.redhat.com/errata/RHSA-2013-0826.html http://security.gentoo.org/glsa/glsa-201308-03.xml http://twitter.com/thezdi/statuses/309771882612281344 http://www.adobe.com/support/security/bulletins/apsb13-15.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16809 https://access.redhat.com&# • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 23%CPEs: 2EXPL: 0CVE-2013-0401 – Oracle Java DragAndDrop Sandbox Bypass Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-0401
Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions. ... Oracle no ha comentado sobre las afirmaciones de otro proveedor de que este problema está relacionado a la invocación del cargador de clases del sistema por la clase sun.awt.datatransfer.ClassLoaderObjectInputStream, que permite a los atacantes remotos omitirlas restricciones del sandbox de Java. ... The issue lies in the ability to bypass checks in the Proxy class. • http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880 http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/31c782610044 http://lists.opensuse.org/opensuse-security-announce/2013-05 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 77%CPEs: 87EXPL: 0CVE-2013-0641 – Adobe Reader Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2013-0641
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013. Vulnerabilidad no especificada en Adobe Reader y Acrobat v9.x hasta v9.5.3, 10.x hasta v10.1.5, v11.0.1 y 11.x que permite a atacantes remotos ejecutar código arbitrario a través de un documento PDF manipulado, explotado libremente en febrero de 2013, una vulnerabilidad diferente a CVE-2013-0640. A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution. • http://blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.html http://blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.html http://blogs.mcafee.com/mcafee-labs/digging-into-the-sandbox-escape-technique-of-the-recent-pdf-exploit http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00024.html http: •
CVSS: 10.0EPSS: 5%CPEs: 241EXPL: 0CVE-2013-1476 – OpenJDK: missing ValueHandlerImpl class constructor access restriction (CORBA, 8000631)
https://notcve.org/view.php?id=CVE-2013-1476
Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors." • http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907457 http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/5116fe321210 http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00034.html http://marc.info/?l=bugtraq&m=136439120408139&a •
CVSS: 10.0EPSS: 5%CPEs: 241EXPL: 0CVE-2013-0426 – OpenJDK: logging insufficient access control checks (Libraries, 6664528)
https://notcve.org/view.php?id=CVE-2013-0426
Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions. • http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907346 http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce105dd2e4de http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00034.html http://marc.info/?l=bugtraq&m=136439120408139& •