CVE-2013-0428

02.02.2013, 00:55

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	10 UNKNOWN	NETWORK	LOW		AV:N/AC:L/Au:N/C:C/I:C/A:C

Base Score

CVSS 3.x

EPSS Score

Percentile: 94.55%

Affected Products (NVD)

Vendor	Product	Version
oracle	jre	1.7.0
oracle	jre	1.7.0
oracle	jre	1.7.0
oracle	jre	1.7.0
oracle	jre	1.7.0
oracle	jre	1.7.0
oracle	jre	1.7.0
oracle	jre	1.7.0
oracle	jre	1.7.0
oracle	jre	1.7.0
oracle	jre	1.7.0
oracle	jdk	1.7.0
oracle	jdk	1.7.0
oracle	jdk	1.7.0
oracle	jdk	1.7.0
oracle	jdk	1.7.0
oracle	jdk	1.7.0
oracle	jdk	1.7.0
oracle	jdk	1.7.0
oracle	jdk	1.7.0
oracle	jdk	1.7.0
oracle	jdk	1.7.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
oracle	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
sun	jre	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
oracle	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
sun	jdk	1.6.0
oracle	jre	1.5.0
oracle	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
sun	jre	1.5.0
oracle	jdk	1.5.0
oracle	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
sun	jdk	1.5.0
oracle	jre	𝑥 ≤ 1.4.2_40
oracle	jre	1.4.2_38
sun	jre	1.4.2
sun	jre	1.4.2_1
sun	jre	1.4.2_2
sun	jre	1.4.2_3
sun	jre	1.4.2_4
sun	jre	1.4.2_5
sun	jre	1.4.2_6
sun	jre	1.4.2_7
sun	jre	1.4.2_8
sun	jre	1.4.2_9
sun	jre	1.4.2_10
sun	jre	1.4.2_11
sun	jre	1.4.2_12
sun	jre	1.4.2_13
sun	jre	1.4.2_14
sun	jre	1.4.2_15
sun	jre	1.4.2_16
sun	jre	1.4.2_17
sun	jre	1.4.2_18
sun	jre	1.4.2_19
sun	jre	1.4.2_20
sun	jre	1.4.2_21
sun	jre	1.4.2_22
sun	jre	1.4.2_23
sun	jre	1.4.2_24
sun	jre	1.4.2_25
sun	jre	1.4.2_26
sun	jre	1.4.2_27
sun	jre	1.4.2_28
sun	jre	1.4.2_29
sun	jre	1.4.2_30
sun	jre	1.4.2_31
sun	jre	1.4.2_32
sun	jre	1.4.2_33
sun	jre	1.4.2_34
sun	jre	1.4.2_35
sun	jre	1.4.2_36
sun	jre	1.4.2_37
oracle	jdk	𝑥 ≤ 1.4.2_40
oracle	jdk	1.4.2_38
sun	jdk	1.4.2
sun	jdk	1.4.2_1
sun	jdk	1.4.2_2
sun	jdk	1.4.2_3
sun	jdk	1.4.2_4
sun	jdk	1.4.2_5
sun	jdk	1.4.2_6
sun	jdk	1.4.2_7
sun	jdk	1.4.2_8
sun	jdk	1.4.2_9
sun	jdk	1.4.2_10
sun	jdk	1.4.2_11
sun	jdk	1.4.2_12
sun	jdk	1.4.2_13
sun	jdk	1.4.2_14
sun	jdk	1.4.2_15
sun	jdk	1.4.2_16
sun	jdk	1.4.2_17
sun	jdk	1.4.2_18
sun	jdk	1.4.2_19
sun	jdk	1.4.2_22
sun	jdk	1.4.2_23
sun	jdk	1.4.2_25
sun	jdk	1.4.2_26
sun	jdk	1.4.2_27
sun	jdk	1.4.2_28
sun	jdk	1.4.2_29
sun	jdk	1.4.2_30
sun	jdk	1.4.2_31
sun	jdk	1.4.2_32
sun	jdk	1.4.2_33
sun	jdk	1.4.2_34
sun	jdk	1.4.2_35
sun	jdk	1.4.2_36
sun	jdk	1.4.2_37

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

openjdk-6

hardy	Fixed 6b27-1.12.3-0ubuntu1~08.04.1 released
lucid	Fixed 6b27-1.12.1-2ubuntu0.10.04.2 released
oneiric	Fixed 6b27-1.12.1-2ubuntu0.11.10.2 released
precise	Fixed 6b27-1.12.1-2ubuntu0.12.04.2 released
quantal	Fixed 6b27-1.12.1-2ubuntu0.12.10.2 released

openjdk-6b18

hardy	dne
lucid	ignored
oneiric	ignored
precise	dne
quantal	dne

openjdk-7

hardy	dne
lucid	dne
oneiric	Fixed 7u13-2.3.6-0ubuntu0.11.10.2 released
precise	Fixed 7u13-2.3.6-0ubuntu0.12.04.1 released
quantal	Fixed 7u13-2.3.6-0ubuntu0.12.10.1 released

sun-java5

hardy	ignored
lucid	dne
oneiric	dne
precise	dne
quantal	dne

sun-java6

hardy	ignored
lucid	dne
oneiric	dne
precise	dne
quantal	dne

openSUSE / SLES Releases

openSUSE Product

Release

java-1_7_0-openjdk

suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12	1.7.0.6-33.3 fixed
suse enterprise server 12 SP1	1.7.0.91-21.2 fixed
suse enterprise server 12 SP2	1.7.0.111-33.1 fixed
suse enterprise server 12 SP3	1.7.0.141-42.1 fixed
suse enterprise server 12 SP4	1.7.0.181-43.15.2 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_7_0-openjdk-demo

suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12	1.7.0.6-33.3 fixed
suse enterprise server 12 SP1	1.7.0.91-21.2 fixed
suse enterprise server 12 SP2	1.7.0.111-33.1 fixed
suse enterprise server 12 SP3	1.7.0.141-42.1 fixed
suse enterprise server 12 SP4	1.7.0.181-43.15.2 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_7_0-openjdk-devel

suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12	1.7.0.6-33.3 fixed
suse enterprise server 12 SP1	1.7.0.91-21.2 fixed
suse enterprise server 12 SP2	1.7.0.111-33.1 fixed
suse enterprise server 12 SP3	1.7.0.141-42.1 fixed
suse enterprise server 12 SP4	1.7.0.181-43.15.2 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_7_0-openjdk-headless

suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12	1.7.0.6-33.3 fixed
suse enterprise server 12 SP1	1.7.0.91-21.2 fixed
suse enterprise server 12 SP2	1.7.0.111-33.1 fixed
suse enterprise server 12 SP3	1.7.0.141-42.1 fixed
suse enterprise server 12 SP4	1.7.0.181-43.15.2 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

java-1.5.0-ibm

RHEL 6

1:1.5.0.16.0-1jpp.1.el6_4

fixed

java-1.5.0-ibm-demo

RHEL 6

1:1.5.0.16.0-1jpp.1.el6_4

fixed

java-1.5.0-ibm-devel

RHEL 6

1:1.5.0.16.0-1jpp.1.el6_4

fixed

java-1.5.0-ibm-javacomm

RHEL 6

1:1.5.0.16.0-1jpp.1.el6_4

fixed

java-1.5.0-ibm-jdbc

RHEL 6

1:1.5.0.16.0-1jpp.1.el6_4

fixed

java-1.5.0-ibm-plugin

RHEL 6

1:1.5.0.16.0-1jpp.1.el6_4

fixed

java-1.5.0-ibm-src

RHEL 6

1:1.5.0.16.0-1jpp.1.el6_4

fixed

java-1.6.0-ibm

RHEL 6

1:1.6.0.13.0-1jpp.3.el6_4

fixed

java-1.6.0-ibm-demo

RHEL 6

1:1.6.0.13.0-1jpp.3.el6_4

fixed

java-1.6.0-ibm-devel

RHEL 6

1:1.6.0.13.0-1jpp.3.el6_4

fixed

java-1.6.0-ibm-javacomm

RHEL 6

1:1.6.0.13.0-1jpp.3.el6_4

fixed

java-1.6.0-ibm-jdbc

RHEL 6

1:1.6.0.13.0-1jpp.3.el6_4

fixed

java-1.6.0-ibm-plugin

RHEL 6

1:1.6.0.13.0-1jpp.3.el6_4

fixed

java-1.6.0-ibm-src

RHEL 6

1:1.6.0.13.0-1jpp.3.el6_4

fixed

java-1.6.0-openjdk

RHEL 6

1:1.6.0.0-1.54.1.11.6.el6_3

fixed

java-1.6.0-openjdk-demo

RHEL 6

1:1.6.0.0-1.54.1.11.6.el6_3

fixed

java-1.6.0-openjdk-devel

RHEL 6

1:1.6.0.0-1.54.1.11.6.el6_3

fixed

java-1.6.0-openjdk-javadoc

RHEL 6

1:1.6.0.0-1.54.1.11.6.el6_3

fixed

java-1.6.0-openjdk-src

RHEL 6

1:1.6.0.0-1.54.1.11.6.el6_3

fixed

java-1.6.0-sun

RHEL 6

1:1.6.0.39-1jpp.1.el6_3

fixed

java-1.6.0-sun-demo

RHEL 6

1:1.6.0.39-1jpp.1.el6_3

fixed

java-1.6.0-sun-devel

RHEL 6

1:1.6.0.39-1jpp.1.el6_3

fixed

java-1.6.0-sun-jdbc

RHEL 6

1:1.6.0.39-1jpp.1.el6_3

fixed

java-1.6.0-sun-plugin

RHEL 6

1:1.6.0.39-1jpp.1.el6_3

fixed

java-1.6.0-sun-src

RHEL 6

1:1.6.0.39-1jpp.1.el6_3

fixed

java-1.7.0-ibm

RHEL 6

1:1.7.0.4.0-1jpp.2.el6_4

fixed

java-1.7.0-ibm-demo

RHEL 6

1:1.7.0.4.0-1jpp.2.el6_4

fixed

java-1.7.0-ibm-devel

RHEL 6

1:1.7.0.4.0-1jpp.2.el6_4

fixed

java-1.7.0-ibm-jdbc

RHEL 6

1:1.7.0.4.0-1jpp.2.el6_4

fixed

java-1.7.0-ibm-plugin

RHEL 6

1:1.7.0.4.0-1jpp.2.el6_4

fixed

java-1.7.0-ibm-src

RHEL 6

1:1.7.0.4.0-1jpp.2.el6_4

fixed

java-1.7.0-openjdk

RHEL 6

1:1.7.0.9-2.3.5.3.el6_3

fixed

java-1.7.0-openjdk-demo

RHEL 6

1:1.7.0.9-2.3.5.3.el6_3

fixed

java-1.7.0-openjdk-devel

RHEL 6

1:1.7.0.9-2.3.5.3.el6_3

fixed

java-1.7.0-openjdk-javadoc

RHEL 6

1:1.7.0.9-2.3.5.3.el6_3

fixed

java-1.7.0-openjdk-src

RHEL 6

1:1.7.0.9-2.3.5.3.el6_3

fixed

java-1.7.0-oracle

RHEL 6

1:1.7.0.13-1jpp.3.el6_3

fixed

java-1.7.0-oracle-devel

RHEL 6

1:1.7.0.13-1jpp.3.el6_3

fixed

java-1.7.0-oracle-javafx

RHEL 6

1:1.7.0.13-1jpp.3.el6_3

fixed

java-1.7.0-oracle-jdbc

RHEL 6

1:1.7.0.13-1jpp.3.el6_3

fixed

java-1.7.0-oracle-plugin

RHEL 6

1:1.7.0.13-1jpp.3.el6_3

fixed

java-1.7.0-oracle-src

RHEL 6

1:1.7.0.13-1jpp.3.el6_3

fixed

References

http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS

http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/c9534e095b37

http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00014.html

http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00034.html

http://marc.info/?l=bugtraq&m=136439120408139&w=2

http://marc.info/?l=bugtraq&m=136570436423916&w=2

http://marc.info/?l=bugtraq&m=136733161405818&w=2

http://rhn.redhat.com/errata/RHSA-2013-0236.html

http://rhn.redhat.com/errata/RHSA-2013-0237.html

http://rhn.redhat.com/errata/RHSA-2013-0245.html

http://rhn.redhat.com/errata/RHSA-2013-0246.html

http://rhn.redhat.com/errata/RHSA-2013-0247.html

http://rhn.redhat.com/errata/RHSA-2013-1455.html

http://rhn.redhat.com/errata/RHSA-2013-1456.html

http://security.gentoo.org/glsa/glsa-201406-32.xml

http://www.kb.cert.org/vuls/id/858729

http://www.mandriva.com/security/advisories?name=MDVSA-2013:095

http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html

http://www.securityfocus.com/bid/57713

http://www.us-cert.gov/cas/techalerts/TA13-032A.html

https://bugzilla.redhat.com/show_bug.cgi?id=907207

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16496

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19474

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19480

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19491

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056

http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS

http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/c9534e095b37

http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00014.html

http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00034.html

http://marc.info/?l=bugtraq&m=136439120408139&w=2

http://marc.info/?l=bugtraq&m=136570436423916&w=2

http://marc.info/?l=bugtraq&m=136733161405818&w=2

http://rhn.redhat.com/errata/RHSA-2013-0236.html

http://rhn.redhat.com/errata/RHSA-2013-0237.html

http://rhn.redhat.com/errata/RHSA-2013-0245.html

http://rhn.redhat.com/errata/RHSA-2013-0246.html

http://rhn.redhat.com/errata/RHSA-2013-0247.html

http://rhn.redhat.com/errata/RHSA-2013-1455.html

http://rhn.redhat.com/errata/RHSA-2013-1456.html

http://security.gentoo.org/glsa/glsa-201406-32.xml

http://www.kb.cert.org/vuls/id/858729

http://www.mandriva.com/security/advisories?name=MDVSA-2013:095

http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html

http://www.securityfocus.com/bid/57713

http://www.us-cert.gov/cas/techalerts/TA13-032A.html

https://bugzilla.redhat.com/show_bug.cgi?id=907207

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16496

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19474

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19480

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19491

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056