Oracle Java 7 Security Manager Bypass Vulnerability (CVE-2013-0422)

Share this post:

A new Java zero-day vulnerability, CVE-2013-0422, was publicly reported on January 10, 2013. Details about this issue are available in a Vulnerability Note published by CERT/CC Carnegie Mellon and also available in Alert (TA13-010A) published by the United States Computer Emergency Readiness Team (US-CERT).

This vulnerability can only be exploited as a client-side attack specifically targeting the browser software located on a user’s desktop; for more information about client-side attacks see “Client-Side Attacks: An Overview“. This vulnerability is not applicable to Java running on servers, desktop applications, nor embedded applications.

The IBM Software Development Kit (SDK) and IBM Java Runtime Environment (JRE) are not vulnerable to this exploit.

If you are using Oracle’s JDK or JRE 7 Update 10 or earlier, see Oracle Security Alert for CVE-2013-0422 for patch information.

Please check back for updates.

More stories

XSA-304 and XSA-305 Security Vulnerabilities

Nov 13, 2019 12:30 pm EST

IBM is aware of reported Intel vulnerabilities, CVE-2018-12207 and CVE-2019-11135, which are addressed by Citrix in the XSA-304 and XSA-305 security advisories. The vulnerabilities potentially could enable a denial of service attack or allow unauthorized access to recent memory content. There are no known malicious exploits of these vulnerabilities, which potentially impact the hypervisor. IBM more

IBM Product Security Incident Response


Nov 6, 2019 8:30 pm EST

IBM acknowledges and thanks the security researchers and organizations listed below for reporting and working with us to resolve one or more security vulnerabilities in our products and services. Disclosures for 2019 Danang Tri Atmaja Jafar Abo Nada Jarad Kopf Neil Kettle, (Trustwave) Rich Mirch Steve Petz   Disclosures for 2018 Artem Metla Cody Wass, more

XSA-299 Security Vulnerability

Oct 31, 2019 12:01 pm EST

IBM is aware of a reported XSA-299 security vulnerability (CVE-2019-18421) that potentially would permit an attacker from within a VSI to elevate privileges to that of the host. There are no known malicious exploits of this vulnerability, which potentially impacts the hypervisor. IBM is implementing updates to remediate this vulnerability. No downtime for clients is more