Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2013-2423: Java Runtime may let attackers alter data remotely

CVE-2013-2423 · published 13 years ago · actively exploited

Summary

The Java Runtime used on Oracle JRE, Ubuntu Linux and openSUSE can be tricked by a remote attacker to change files or data. This could affect the integrity of your systems. Apply the latest updates for the Java Runtime and keep your operating system patches current to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	java runtime environment (jre)	All versions
oracle	jre	1.7.0 `cpe:2.3:a:oracle:jre:1.7.0:-::::::`
canonical	ubuntu_linux	12.10 `cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*`
opensuse	opensuse	12.3 `cpe:2.3:o:opensuse:opensuse:12.3:::::::*`

Original advisory text

Oracle JRE Unspecified Vulnerability

Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.

References

http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk... Broken Link
http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html Not Applicable
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f Patch
http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0752.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0757.html Third Party Advisory
http://security.gentoo.org/glsa/glsa-201406-32.xml Third Party Advisory
http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0 Broken Link
http://www.exploit-db.com/exploits/24976 Third Party Advisory VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:161 Third Party Advisory
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html Vendor Advisory
http://www.ubuntu.com/usn/USN-1806-1 Third Party Advisory
http://www.us-cert.gov/ncas/alerts/TA13-107A Third Party Advisory US Government Resource
https://bugzilla.redhat.com/show_bug.cgi?id=952398 Issue Tracking
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3... Broken Link
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-... US Government Resource

Fix within

Internet-facing 14 days

Internal 14 days

Known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.7 Low

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

85% chance of attack within 30 days

Type

CWE-284Improper Access Control

Timeline

Published17 Apr 2013

Updated30 Sep 2026

First seen6 Mar 2026

Sources

CVE-2013-2423 · CISA KEV

CVE-2013-2423 · NVD

Track software like this

Free during beta