DOWNLOAD

Oracle Security Alert for CVE-2013-1493

Description

This Security Alert addresses security issues CVE-2013-1493 (US-CERT VU#688246) and another vulnerability affecting   Java running in web browsers. These vulnerabilities are not applicable to Java running on servers, standalone Java   desktop applications or embedded Java applications. They also do not affect Oracle server-based software.

These vulnerabilities may be remotely exploitable without authentication, i.e., they may be exploited over a network without the need for a username and password. For an exploit to be successful, an unsuspecting user running an affected release in a browser must visit a malicious web page that leverages these vulnerabilities.   Successful exploits can impact the availability, integrity, and confidentiality of the user's system.

Due to the severity of these vulnerabilities, and the reported exploitation of CVE-2013-1493 "in the wild," Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as   possible.

Supported Products Affected

The security vulnerabilities addressed by this Security Alert affect the products listed in the categories   below.  Please click on the link in the Patch Availability column or in the Patch Availability Table to access the documentation for those patches.

Affected product releases and versions:

Patch Availability Table and Risk Matrix

Java SE fixes in this Security Alert are cumulative; this latest update includes all fixes from previous Critical   Patch Updates and Security Alerts.

Patch Availability Table

Credit Statement

The following people or organizations reported security vulnerabilities addressed by this Security Alert to Oracle: an Anonymous Reporter of TippingPoint's Zero Day Initiative;  axtaxt viaTipping Point's Zero Day Initiative;  Darien Kindlund of FireEye;  Vitaliy Toropov via iDefense; and  Vitaliy Toropov via TippingPoint.

References

    
• Oracle Critical Patch Updates and Security   Alerts main page [ Oracle Technology   Network ]
    
• Oracle Critical Patch Updates and Security   Alerts - Frequently Asked Questions [   CPU FAQ ]
    
• Risk Matrix definitions [ Risk Matrix Definitions   ]
    
• Use of Common Vulnerability Scoring System   (CVSS) by Oracle [ Oracle   CVSS Scoring ]
    
• English text version of risk matrix [ Oracle Technology Network ]
    
• CVRF XML version of the risk matrix [ //www.oracle.com/ocom/groups/public/@otn/documents/webcontent/1915099.xml">Oracle Technology Network ]
    
• Previous Security Advisories for Java SE   and Java for Business Security Updates [ Java Sun Alerts Archive Page ]

Modification History