CVEvulnerability
CVE-2013-0402
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-03-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-119
Description
Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
Affected configurations
• oracle javafx (<= 2.2.7)
• oracle jdk 1.7.0
• oracle jre 1.7.0
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 h30499.www3.hp.com
- http://rhn.redhat.com/errata/RHSA-2013-0757.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html Vendor Advisory
- http://www.us-cert.gov/ncas/alerts/TA13-107A US Government Resource
- http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ www.zdnet.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15728 oval.cisecurity.org
- https://twitter.com/thezdi/status/309484730506698752 twitter.com
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 h30499.www3.hp.com
- http://rhn.redhat.com/errata/RHSA-2013-0757.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html Vendor Advisory
- http://www.us-cert.gov/ncas/alerts/TA13-107A US Government Resource
- http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ www.zdnet.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15728 oval.cisecurity.org
- https://twitter.com/thezdi/status/309484730506698752 twitter.com