Vulnerability details

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

• http://security.gentoo.org/glsa/glsa-201406-32.xml vendor-advisoryx_refsource_GENTOO
• http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0 x_refsource_MISC
• http://www.us-cert.gov/ncas/alerts/TA13-107A third-party-advisoryx_refsource_CERT
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 x_refsource_CONFIRM
• http://rhn.redhat.com/errata/RHSA-2013-0757.html vendor-advisoryx_refsource_REDHAT
• http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f x_refsource_MISC
• http://www.exploit-db.com/exploits/24976 exploitx_refsource_EXPLOIT-DB
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:161 vendor-advisoryx_refsource_MANDRIVA
• http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html vendor-advisoryx_refsource_SUSE
• http://rhn.redhat.com/errata/RHSA-2013-0752.html vendor-advisoryx_refsource_REDHAT
• http://www.ubuntu.com/usn/USN-1806-1 vendor-advisoryx_refsource_UBUNTU
• http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html x_refsource_MISC
• https://bugzilla.redhat.com/show_bug.cgi?id=952398 x_refsource_CONFIRM
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16700 vdb-entrysignaturex_refsource_OVAL
• http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html x_refsource_CONFIRM
• http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ x_refsource_CONFIRM
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2423 government-resource