OpenJDK: PresentationManager incorrectly shared (CORBA, 7141694)
Published Feb 2, 2013
7.6
HIGHCVSS 2.0
EPSS 6.70%
Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue involves the creation of a single PresentationManager that is shared across multiple thread groups, which allows remote attackers to bypass Java sandbox restrictions.
Affected products
No data.
Configuration 1
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
Configuration 2
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
- 1.7.0
Configuration 3
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
Configuration 4
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
Configuration 5
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
Configuration 6
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
No data.
Red Hat Enterprise Linux 5
java-1.6.0-openjdk-1:1.6.0.0-1.33.1.11.6.el5_9
Fixed · RHSA-2013:0246
Red Hat Enterprise Linux 5
java-1.7.0-openjdk-1:1.7.0.9-2.3.5.3.el5_9
Fixed · RHSA-2013:0247
Red Hat Enterprise Linux 6
java-1.6.0-openjdk-1:1.6.0.0-1.54.1.11.6.el6_3
Fixed · RHSA-2013:0245
Red Hat Enterprise Linux 6
java-1.7.0-openjdk-1:1.7.0.9-2.3.5.3.el6_3
Fixed · RHSA-2013:0247
Supplementary for Red Hat Enterprise Linux 5
java-1.6.0-sun-1:1.6.0.39-1jpp.4.el5_9
Fixed · RHSA-2013:0236
Supplementary for Red Hat Enterprise Linux 5
java-1.7.0-oracle-1:1.7.0.13-1jpp.1.el5_9
Fixed · RHSA-2013:0237
Supplementary for Red Hat Enterprise Linux 6
java-1.6.0-sun-1:1.6.0.39-1jpp.1.el6_3
Fixed · RHSA-2013:0236
Supplementary for Red Hat Enterprise Linux 6
java-1.7.0-oracle-1:1.7.0.13-1jpp.3.el6_3
Fixed · RHSA-2013:0237
Red Hat Enterprise Linux 5
java-1.4.2-ibm
Will not fix
Red Hat Enterprise Linux 5
java-1.5.0-ibm
Not affected
Red Hat Enterprise Linux 5
java-1.6.0-ibm
Not affected
Red Hat Enterprise Linux 5
java-1.7.0-ibm
Not affected
Red Hat Enterprise Linux 6
java-1.5.0-ibm
Not affected
Red Hat Enterprise Linux 6
java-1.6.0-ibm
Not affected
Red Hat Enterprise Linux 6
java-1.7.0-ibm
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-1:1.6.0.0-1.33.1.11.6.el5_9 | Fixed | RHSA-2013:0246 |
| Red Hat Enterprise Linux 5 | java-1.7.0-openjdk-1:1.7.0.9-2.3.5.3.el5_9 | Fixed | RHSA-2013:0247 |
| Red Hat Enterprise Linux 6 | java-1.6.0-openjdk-1:1.6.0.0-1.54.1.11.6.el6_3 | Fixed | RHSA-2013:0245 |
| Red Hat Enterprise Linux 6 | java-1.7.0-openjdk-1:1.7.0.9-2.3.5.3.el6_3 | Fixed | RHSA-2013:0247 |
| Supplementary for Red Hat Enterprise Linux 5 | java-1.6.0-sun-1:1.6.0.39-1jpp.4.el5_9 | Fixed | RHSA-2013:0236 |
| Supplementary for Red Hat Enterprise Linux 5 | java-1.7.0-oracle-1:1.7.0.13-1jpp.1.el5_9 | Fixed | RHSA-2013:0237 |
| Supplementary for Red Hat Enterprise Linux 6 | java-1.6.0-sun-1:1.6.0.39-1jpp.1.el6_3 | Fixed | RHSA-2013:0236 |
| Supplementary for Red Hat Enterprise Linux 6 | java-1.7.0-oracle-1:1.7.0.13-1jpp.3.el6_3 | Fixed | RHSA-2013:0237 |
| Red Hat Enterprise Linux 5 | java-1.4.2-ibm | Will not fix | n/a |
| Red Hat Enterprise Linux 5 | java-1.5.0-ibm | Not affected | n/a |
| Red Hat Enterprise Linux 5 | java-1.6.0-ibm | Not affected | n/a |
| Red Hat Enterprise Linux 5 | java-1.7.0-ibm | Not affected | n/a |
| Red Hat Enterprise Linux 6 | java-1.5.0-ibm | Not affected | n/a |
| Red Hat Enterprise Linux 6 | java-1.6.0-ibm | Not affected | n/a |
| Red Hat Enterprise Linux 6 | java-1.7.0-ibm | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
No CWE recorded.
References (29)
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907460 x_refsource_CONFIRM
- http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS x_refsource_CONFIRM
- http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/c1ed8145c1b8 x_refsource_CONFIRM
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00014.html vendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html vendor-advisoryx_refsource_SUSE
- http://marc.info/?l=bugtraq&m=136439120408139&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=136570436423916&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=136733161405818&w=2 vendor-advisoryx_refsource_HP
- http://rhn.redhat.com/errata/RHSA-2013-0236.html vendor-advisoryx_refsource_REDHAT
- http://rhn.redhat.com/errata/RHSA-2013-0237.html vendor-advisoryx_refsource_REDHAT
- http://rhn.redhat.com/errata/RHSA-2013-0245.html vendor-advisoryx_refsource_REDHAT
- http://rhn.redhat.com/errata/RHSA-2013-0246.html vendor-advisoryx_refsource_REDHAT
- http://rhn.redhat.com/errata/RHSA-2013-0247.html vendor-advisoryx_refsource_REDHAT
- http://security.gentoo.org/glsa/glsa-201406-32.xml vendor-advisoryx_refsource_GENTOO
- http://www.kb.cert.org/vuls/id/858729 third-party-advisoryx_refsource_CERT-VNUS Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:095 vendor-advisoryx_refsource_MANDRIVA
- http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html x_refsource_CONFIRMVendor Advisory
- http://www.securityfocus.com/bid/57710 vdb-entryx_refsource_BID
- http://www.us-cert.gov/cas/techalerts/TA13-032A.html third-party-advisoryx_refsource_CERTUS Government Resource
- https://access.redhat.com/security/cve/CVE-2013-0429 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=907460 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-0440 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2013-0429
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16649 vdb-entrysignaturex_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19300 vdb-entrysignaturex_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19342 vdb-entrysignaturex_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19457 vdb-entrysignaturex_refsource_OVAL
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 x_refsource_CONFIRM
- https://www.cve.org/CVERecord?id=CVE-2013-0429
Change history (0)
No recorded changes yet.