CVE-2013-2465Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remo…
Updated under an hour ago ()
Does this affect you?
It affects oracle jre and 5 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Mar 28, 2022; federal agencies had to remediate by Apr 18, 2022, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Free account, 1 product
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
- CVSS
- 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-693
- Known exploited
- Added to CISA KEV Mar 28, 2022; federal remediation due Apr 18, 2022; known ransomware useApply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 98.80% (percentile 100)
- Assigned by
- oracle
- NVD analysis
- Analyzed
- Record last updated
- Oct 22, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
oracle jre oracle:jre | 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; and 34 more ranges | NVD |
sun jre sun:jre | 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; and 42 more ranges | NVD |
suse linux_enterprise_desktop suse:linux_enterprise_desktop | 10 | NVD |
suse linux_enterprise_java suse:linux_enterprise_java | 10; 11; 11 | NVD |
suse linux_enterprise_server suse:linux_enterprise_server | 10; 10; 11; 11; 11; 11 | NVD |
suse linux_enterprise_software_development_kit suse:linux_enterprise_software_development_kit | 11; 11 | NVD |
References
- http://rhn.redhat.com/errata/RHSA-2013-1060.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- http://marc.info/?l=bugtraq&m=137545592101387&w=2vendor-advisory, x-refsource-hp, mailing-list, third-party-advisory
- https://access.redhat.com/errata/RHSA-2014:0414vendor-advisory, x-refsource-redhat
- http://security.gentoo.org/glsa/glsa-201406-32.xmlvendor-advisory, x-refsource-gentoo, third-party-advisory
- http://www.securityfocus.com/bid/60657vdb-entry, x-refsource-bid, broken-link, third-party-advisory
- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.htmlx-refsource-confirm, vendor-advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- http://marc.info/?l=bugtraq&m=137545505800971&w=2vendor-advisory, x-refsource-hp, mailing-list, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- http://secunia.com/advisories/54154third-party-advisory, x-refsource-secunia, not-applicable
- http://rhn.redhat.com/errata/RHSA-2013-1455.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880vendor-advisory, x-refsource-hp, broken-link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19455vdb-entry, signature, x-refsource-oval
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19703vdb-entry, signature, x-refsource-oval
- http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040x-refsource-misc, patch
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19074vdb-entry, signature, x-refsource-oval
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- http://rhn.redhat.com/errata/RHSA-2013-1059.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17106vdb-entry, signature, x-refsource-oval
- http://rhn.redhat.com/errata/RHSA-2013-1081.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- http://www.us-cert.gov/ncas/alerts/TA13-169Athird-party-advisory, x-refsource-cert, us-government-resource
- http://advisories.mageia.org/MGASA-2013-0185.htmlx-refsource-confirm, broken-link
- http://rhn.redhat.com/errata/RHSA-2013-0963.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.htmlmailing-list, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.htmlmailing-list, third-party-advisory
- http://rhn.redhat.com/errata/RHSA-2013-1456.htmlthird-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21642336third-party-advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:183not-applicable
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.