CVE-2013-2447

NameCVE-2013-2447
DescriptionUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to obtain a socket's local address via vectors involving inconsistencies between Socket.getLocalAddress and InetAddress.getLocalHost.
SourceCVE (at NVD; LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-2722-1, DSA-2727-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openjdk-6 (PTS)wheezy6b27-1.12.5-1vulnerable
wheezy (security)6b38-1.13.10-1~deb7u1fixed
openjdk-7 (PTS)wheezy7u91-2.6.3-1~deb7u1fixed
wheezy (security)7u101-2.6.6-2~deb7u1fixed
jessie7u91-2.6.3-1~deb8u1fixed
jessie (security)7u101-2.6.6-1~deb8u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openjdk-6source(unstable)6b27-1.12.6-1medium
openjdk-6sourcesqueeze6b27-1.12.6-1~deb6u1mediumDSA-2727-1
openjdk-6sourcewheezy6b27-1.12.6-1~deb7u1mediumDSA-2727-1
openjdk-7source(unstable)7u25-2.3.10-1medium
openjdk-7sourcewheezy7u25-2.3.10-1~deb7u1mediumDSA-2722-1

Search for package or bug name: Reporting problems