CVE-2013-2453

NameCVE-2013-2453
DescriptionUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect integrity via vectors related to JMX. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to a missing check for "package access" by the MBeanServer Introspector.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-2722-1, DSA-2727-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openjdk-6 (PTS)wheezy, wheezy (security)6b38-1.13.10-1~deb7u1fixed
openjdk-7 (PTS)wheezy7u95-2.6.4-1~deb7u1fixed
wheezy (security)7u101-2.6.6-2~deb7u1fixed
jessie7u101-2.6.6-2~deb8u1fixed
jessie (security)7u101-2.6.6-1~deb8u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openjdk-6source(unstable)6b27-1.12.6-1medium
openjdk-6sourcesqueeze6b27-1.12.6-1~deb6u1mediumDSA-2727-1
openjdk-6sourcewheezy6b27-1.12.6-1~deb7u1mediumDSA-2727-1
openjdk-7source(unstable)7u25-2.3.10-1medium
openjdk-7sourcewheezy7u25-2.3.10-1~deb7u1mediumDSA-2722-1

Search for package or bug name: Reporting problems