Oracle Java 7 Security Manager Bypass Vulnerability (CVE-2013-0422)

Share this post:


A new Java zero-day vulnerability, CVE-2013-0422, was publicly reported on January 10, 2013. Details about this issue are available in a Vulnerability Note published by CERT/CC Carnegie Mellon and also available in Alert (TA13-010A) published by the United States Computer Emergency Readiness Team (US-CERT).

This vulnerability can only be exploited as a client-side attack specifically targeting the browser software located on a user’s desktop; for more information about client-side attacks see “Client-Side Attacks: An Overview“. This vulnerability is not applicable to Java running on servers, desktop applications, nor embedded applications.

The IBM Software Development Kit (SDK) and IBM Java Runtime Environment (JRE) are not vulnerable to this exploit.

If you are using Oracle’s JDK or JRE 7 Update 10 or earlier, see Oracle Security Alert for CVE-2013-0422 for patch information.

Please check back for updates.

More stories

IBM Product Security Incident Response

Acknowledgement

May 20, 2020 9:00 am EDT

IBM acknowledges and thanks the security researchers and organizations listed below for reporting and working with us to resolve one or more security vulnerabilities in our products and services. Disclosures for 2020 Honggang Ren of Fortinet’s FortiGuard Labs Pawel Gocyla, (ING Tech Poland) Dries Eestermans, (nynox-dries)   Disclosures for 2019 Danang Tri Atmaja Jafar Abo ...read more


A new and advanced Rowhammer-based attack on DDR4 memory

Mar 11, 2020 8:59 am EDT

A new and advanced Rowhammer-based attack on DDR4 memory was announced on March 10, 2020. (CVE-2020-10255) The attack has been shown to cause memory corruption in lab environments. Vulnerability exploitation on IBM Power processor architectures, IBM Z-based architectures, IBM Cloud and IBM storage products would be difficult. No customer actions are currently required. IBM Power ...read more


XSA-353 Security Vulnerabilities

Nov 13, 2019 12:30 pm EST

Security vulnerability CVE-2020-29479 could potentially enable a denial of service attack or allow unauthorized access to the hypervisor, and is addressed by Citrix in XSA-353 security advisories. IBM Cloud has worked with its technology partners to deploy mitigation and remediation measures. There is no known malicious exploit of this vulnerability at this time. ...read more