Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2013-2470: Java JRE allows remote attackers to breach security

CVE-2013-2470 · published 13 years ago

Summary

Versions of Oracle Java SE 5, 6, and 7 up to the listed updates, as well as OpenJDK 7, contain a flaw that could let an attacker read, change, or disrupt your data. The problem is related to the way the Java graphics library processes images. Upgrade to the latest Java release or apply the vendor’s security update as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	jre	<= 1.7.0 1.7.0 <= 1.6.0 1.6.0 <= 1.5.0 1.5.0 `cpe:2.3:a:oracle:jre::update21::::::*`
oracle	jdk	<= 1.7.0 1.7.0 <= 1.6.0 1.6.0 <= 1.5.0 1.5.0 `cpe:2.3:a:oracle:jdk::update21::::::*`
sun	jre	1.6.0 1.5.0 `cpe:2.3:a:sun:jre:1.6.0:::::::*`
sun	jdk	1.6.0 1.5.0 `cpe:2.3:a:sun:jdk:1.6.0:::::::*`

Original advisory text

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "ImagingLib byte lookup processing."

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

23% chance of attack within 30 days

Timeline

Published18 Jun 2013

Updated29 Sep 2026

First seen29 Sep 2026

Sources

CVE-2013-2470 · NVD

Track software like this

Free during beta