CVE-2013-1493

Upstream information

CVE-2013-1493 at MITRE

Description

The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.

SUSE information

CVSS v2 Scores
	National Vulnerability Database
Base Score	10.00
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	Complete
Integrity Impact	Complete
Availability Impact	Complete

SUSE Bugzilla entries: 806786 [RESOLVED / UPSTREAM], 807487 [RESOLVED / FIXED], 809386 [RESOLVED / FIXED], 813939 [RESOLVED / FIXED]

SUSE Security Advisories:

SUSE-SU-2013:0434-1, published Tue, 12 Mar 2013 18:04:47 +0100 (CET)
openSUSE-SU-2013:0430-1, published Tue, 12 Mar 2013 11:04:28 +0100 (CET)
openSUSE-SU-2013:0438-1, published Tue, 12 Mar 2013 21:04:28 +0100 (CET)
openSUSE-SU-2013:0509-1, published Wed, 20 Mar 2013 17:04:46 +0100 (CET)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Desktop 11 SP2	`java-1_6_0-openjdk >= 1.6.0.0_b27.1.12.4-0.2.1` `java-1_6_0-openjdk-demo >= 1.6.0.0_b27.1.12.4-0.2.1` `java-1_6_0-openjdk-devel >= 1.6.0.0_b27.1.12.4-0.2.1`	Patchnames: sledsp2-java-1_6_0-openjdk
SUSE Linux Enterprise Software Development Kit 11 SP2	`java-1_6_0-ibm >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.1-0.9.1`	Builds SAT Patch Nr: 7627
SUSE Linux Enterprise Software Development Kit 11 SP2	`java-1_6_0-ibm-devel >= 1.6.0_sr13.1-0.9.1`	Builds SAT Patch Nr: 7627
SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware	`java-1_6_0-ibm >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-alsa >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.1-0.9.1`	Builds SAT Patch Nr: 7627
SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware	`java-1_6_0-ibm >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.1-0.9.1`	Builds SAT Patch Nr: 7627
SUSE Linux Enterprise Server 11 SP2	`java-1_6_0-ibm >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.1-0.9.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.1-0.9.1`	Builds SAT Patch Nr: 7627
SUSE Linux Enterprise Software Development Kit 11 SP2	`java-1_4_2-ibm >= 1.4.2_sr13.16-0.2.1` `java-1_4_2-ibm-devel >= 1.4.2_sr13.16-0.2.1`	Builds SAT Patch Nr: 7618
SUSE Linux Enterprise Software Development Kit 11 SP2	`java-1_4_2-ibm-devel >= 1.4.2_sr13.16-0.2.1`	Builds SAT Patch Nr: 7618
SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware	`java-1_4_2-ibm >= 1.4.2_sr13.16-0.2.1` `java-1_4_2-ibm-jdbc >= 1.4.2_sr13.16-0.2.1` `java-1_4_2-ibm-plugin >= 1.4.2_sr13.16-0.2.1`	Builds SAT Patch Nr: 7618
SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware	`java-1_4_2-ibm >= 1.4.2_sr13.16-0.2.1`	Builds SAT Patch Nr: 7618
SUSE Linux Enterprise Server 10 SP4 for x86	`java-1_6_0-ibm >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-alsa >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.1-0.14.1`	Builds ZYPP Patch Nr: 8544
SUSE Linux Enterprise Server 10 SP4 for IBM POWER	`java-1_6_0-ibm >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-64bit >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.1-0.14.1`	Builds ZYPP Patch Nr: 8544
SUSE Linux Enterprise Server 10 SP4 for IBM zSeries 64bit	`java-1_6_0-ibm >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-32bit >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-devel-32bit >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.1-0.14.1`	Builds ZYPP Patch Nr: 8544
SUSE Linux Enterprise Server 10 SP4 for AMD64 and Intel EM64T	`java-1_6_0-ibm >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-32bit >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-alsa-32bit >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-devel-32bit >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.1-0.14.1` `java-1_6_0-ibm-plugin-32bit >= 1.6.0_sr13.1-0.14.1`	Builds ZYPP Patch Nr: 8544
SUSE Linux Enterprise Desktop 10 SP4 for x86	`java-1_5_0-ibm >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-alsa >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-demo >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-jdbc >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-plugin >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-src >= 1.5.0_sr16.1-0.5.1`	Builds ZYPP Patch Nr: 8542
SUSE Linux Enterprise Desktop 10 SP4 for AMD64 and Intel EM64T	`java-1_5_0-ibm >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-32bit >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-alsa-32bit >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-demo >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-devel-32bit >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-src >= 1.5.0_sr16.1-0.5.1`	Builds ZYPP Patch Nr: 8542
SUSE Linux Enterprise Server 10 SP4 for x86	`java-1_5_0-ibm >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-alsa >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-jdbc >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-plugin >= 1.5.0_sr16.1-0.5.1`	Builds ZYPP Patch Nr: 8542
SUSE Linux Enterprise Server 10 SP4 for IBM POWER	`java-1_5_0-ibm >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-64bit >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-jdbc >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-plugin >= 1.5.0_sr16.1-0.5.1`	Builds ZYPP Patch Nr: 8542
SUSE Linux Enterprise Server 10 SP4 for IBM zSeries 64bit	`java-1_5_0-ibm >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-32bit >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-devel-32bit >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.1-0.5.1`	Builds ZYPP Patch Nr: 8542
SUSE Linux Enterprise Server 10 SP4 for AMD64 and Intel EM64T	`java-1_5_0-ibm >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-32bit >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-alsa-32bit >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-devel-32bit >= 1.5.0_sr16.1-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.1-0.5.1`	Builds ZYPP Patch Nr: 8542
SUSE Linux Enterprise Server 10 SP4 for x86	`java-1_4_2-ibm >= 1.4.2_sr13.16-0.5.1` `java-1_4_2-ibm-devel >= 1.4.2_sr13.16-0.5.1` `java-1_4_2-ibm-jdbc >= 1.4.2_sr13.16-0.5.1` `java-1_4_2-ibm-plugin >= 1.4.2_sr13.16-0.5.1`	Builds ZYPP Patch Nr: 8543
SUSE Linux Enterprise Server 10 SP4 for AMD64 and Intel EM64T SUSE Linux Enterprise Server 10 SP4 for IBM zSeries 64bit SUSE Linux Enterprise Server 10 SP4 for IPF	`java-1_4_2-ibm >= 1.4.2_sr13.16-0.5.1` `java-1_4_2-ibm-devel >= 1.4.2_sr13.16-0.5.1`	Builds ZYPP Patch Nr: 8543
SUSE Linux Enterprise Server 10 SP4 for IBM POWER	`java-1_4_2-ibm >= 1.4.2_sr13.16-0.5.1` `java-1_4_2-ibm-devel >= 1.4.2_sr13.16-0.5.1` `java-1_4_2-ibm-jdbc >= 1.4.2_sr13.16-0.5.1`	Builds ZYPP Patch Nr: 8543
SUSE Linux Enterprise Desktop 11 SP2	`java-1_6_0-openjdk >= 1.6.0.0_b27.1.12.4-0.2.1` `java-1_6_0-openjdk-demo >= 1.6.0.0_b27.1.12.4-0.2.1` `java-1_6_0-openjdk-devel >= 1.6.0.0_b27.1.12.4-0.2.1`	Builds SAT Patch Nr: 7457
openSUSE 12.3	`java-1_7_0-openjdk >= 1.7.0.6-8.8.1` `java-1_7_0-openjdk-debuginfo >= 1.7.0.6-8.8.1` `java-1_7_0-openjdk-debugsource >= 1.7.0.6-8.8.1` `java-1_7_0-openjdk-demo >= 1.7.0.6-8.8.1` `java-1_7_0-openjdk-demo-debuginfo >= 1.7.0.6-8.8.1` `java-1_7_0-openjdk-devel >= 1.7.0.6-8.8.1` `java-1_7_0-openjdk-devel-debuginfo >= 1.7.0.6-8.8.1` `java-1_7_0-openjdk-javadoc >= 1.7.0.6-8.8.1` `java-1_7_0-openjdk-src >= 1.7.0.6-8.8.1`	Patchnames: openSUSE-2013-230
openSUSE Evergreen 11.4	`java-1_6_0-openjdk >= 1.6.0.0_b27.1.12.4-33.1` `java-1_6_0-openjdk-debuginfo >= 1.6.0.0_b27.1.12.4-33.1` `java-1_6_0-openjdk-debugsource >= 1.6.0.0_b27.1.12.4-33.1` `java-1_6_0-openjdk-demo >= 1.6.0.0_b27.1.12.4-33.1` `java-1_6_0-openjdk-demo-debuginfo >= 1.6.0.0_b27.1.12.4-33.1` `java-1_6_0-openjdk-devel >= 1.6.0.0_b27.1.12.4-33.1` `java-1_6_0-openjdk-devel-debuginfo >= 1.6.0.0_b27.1.12.4-33.1` `java-1_6_0-openjdk-javadoc >= 1.6.0.0_b27.1.12.4-33.1` `java-1_6_0-openjdk-src >= 1.6.0.0_b27.1.12.4-33.1`	Patchnames: 2013-39

CVE-2013-1493

Common Vulnerabilities and Exposures

Upstream information

Description

SUSE information

List of released packages

Services