The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openjdk6. | Aug 30, 2017 | Apr 17, 2013 |
| Apple Java | — | Upgrade to Apple Java version 1.6.0.41 | Feb 21, 2013 | Feb 21, 2013 |
| Centos_linux | — | Upgrade java-1.6.0-openjdkUpgrade java-1.7.0-openjdk-srcUpgrade java-1.6.0-openjdk-srcUpgrade java-1.7.0-openjdk-demoUpgrade java-1.7.0-openjdkUpgrade java-1.7.0-openjdk-develUpgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk-javadocUpgrade java-1.7.0-openjdk-javadocUpgrade java-1.6.0-openjdk-demo | Dec 1, 2016 | Mar 8, 2013 |
| Gentoo Linux | — | Upgrade dev-java/sun-jdk.Upgrade app-emulation/emul-linux-x86-java.Upgrade dev-java/oracle-jre-bin.Upgrade dev-java/icedtea-bin.Upgrade dev-java/oracle-jdk-bin.Upgrade dev-java/sun-jre-bin. | Oct 30, 2017 | Mar 8, 2013 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Apr 16, 2013 | Mar 8, 2013 |
| Oracle Solaris | — | Upgrade developer/java/jdk-7 to version 1.7.0.21-0.175.1.7.0.4.0 on Solaris 11.1Upgrade runtime/java/jre to version 1.7.0.21-0.175.1.7.0.4.0 on Solaris 11.1Upgrade library/java/java-demo-7 to version 1.7.0.21-0.175.1.7.0.4.0 on Solaris 11.1Upgrade runtime/java/jre-7 to version 1.7.0.21-0.175.1.7.0.4.0 on Solaris 11.1 | May 29, 2017 | Mar 8, 2013 |
| Oracle_linux | — | Upgrade java-1.6.0-openjdkUpgrade java-1.6.0-openjdk-develUpgrade java-1.7.0-openjdk-srcUpgrade java-1.7.0-openjdk-develUpgrade java-1.7.0-openjdk-demoUpgrade java-1.6.0-openjdk-srcUpgrade java-1.7.0-openjdk-javadocUpgrade java-1.7.0-openjdkUpgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdk-demo | Oct 16, 2024 | Mar 8, 2013 |
| Suse | — | Upgrade java-1_6_0-openjdk-javadocUpgrade java-1_6_0-openjdk-demoUpgrade java-1_7_0-openjdkUpgrade java-1_7_0-openjdk-srcUpgrade java-1_6_0-openjdk-debuginfoUpgrade java-1_6_0-openjdk-develUpgrade java-1_7_0-openjdk-develUpgrade java-1_7_0-openjdk-javadocUpgrade java-1_7_0-openjdk-demoUpgrade java-1_6_0-openjdkUpgrade java-1_6_0-openjdk-demo-debuginfoUpgrade java-1_6_0-openjdk-debugsourceUpgrade java-1_6_0-openjdk-srcUpgrade java-1_6_0-openjdk-devel-debuginfo | Feb 17, 2015 | Mar 8, 2013 |
| Ubuntu | — | Upgrade icedtea-6-jre-cacaoUpgrade openjdk-7-jre-headlessUpgrade openjdk-6-jre-libUpgrade icedtea-7-jre-jamvmUpgrade openjdk-7-jreUpgrade openjdk-6-jre-headlessUpgrade openjdk-6-jreUpgrade openjdk-7-jre-zeroUpgrade openjdk-7-jre-libUpgrade openjdk-6-jre-zeroUpgrade icedtea-6-jre-jamvm | Nov 8, 2024 | Mar 8, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub