CVE-2013-2422

Upstream information

CVE-2013-2422 at MITRE

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper method-invocation restrictions by the MethodUtil trampoline class, which allows remote attackers to bypass the Java sandbox.

SUSE information

CVSS v2 Scores
	National Vulnerability Database
Base Score	10.00
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	Complete
Integrity Impact	Complete
Availability Impact	Complete

SUSE Bugzilla entries: 816720 [RESOLVED / FIXED], 817157 [RESOLVED / FIXED], 819288 [RESOLVED / FIXED]

SUSE Security Advisories:

SUSE-SU-2013:0814-1, published Tue, 21 May 2013 20:04:20 +0200 (CEST)
SUSE-SU-2013:0835-1, published Mon, 27 May 2013 17:05:24 +0200 (CEST)
SUSE-SU-2013:0835-2, published Mon, 10 Jun 2013 15:04:15 +0200 (CEST)
SUSE-SU-2013:0835-3, published Tue, 2 Jul 2013 19:04:22 +0200 (CEST)
SUSE-SU-2013:0871-1, published Mon, 10 Jun 2013 15:04:12 +0200 (CEST)
SUSE-SU-2013:0871-2, published Wed, 3 Jul 2013 15:04:18 +0200 (CEST)
openSUSE-SU-2013:0745-1, published Fri, 3 May 2013 14:04:26 +0200 (CEST)
openSUSE-SU-2013:0777-1, published Fri, 10 May 2013 17:05:09 +0200 (CEST)
openSUSE-SU-2013:0964-1, published Mon, 10 Jun 2013 18:21:39 +0200 (CEST)
openSUSE-SU-2013:0993-1, published Mon, 10 Jun 2013 18:31:59 +0200 (CEST)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Desktop 11 SP2	`java-1_6_0-openjdk >= 1.6.0.0_b27.1.12.5-0.2.1` `java-1_6_0-openjdk-demo >= 1.6.0.0_b27.1.12.5-0.2.1` `java-1_6_0-openjdk-devel >= 1.6.0.0_b27.1.12.5-0.2.1`	Patchnames: sledsp2-java-1_6_0-openjdk
SUSE Linux Enterprise Server 11 SP2	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-alsa >= 1.6.0_sr15.0-0.5.1` `java-1_6_0-ibm-devel >= 1.6.0_sr16.0-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.3.1` `java-1_7_0-ibm >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-alsa >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-devel >= 1.7.0_sr7.0-0.5.1` `java-1_7_0-ibm-jdbc >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-plugin >= 1.7.0_sr4.2-0.6.1`	Patchnames: slessp2-java-1_6_0-ibm slessp2-java-1_7_0-ibm
SUSE Linux Enterprise Server 11 SP3	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-alsa >= 1.6.0_sr16.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.3.1` `java-1_7_0-ibm >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-alsa >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-jdbc >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-plugin >= 1.7.0_sr4.2-0.6.1`	Patchnames: slessp3-java-1_6_0-ibm slessp3-java-1_7_0-ibm
SUSE Linux Enterprise Server for VMWare 11 SP2	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-alsa >= 1.6.0_sr15.0-0.5.1` `java-1_6_0-ibm-devel >= 1.6.0_sr16.0-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.3.1` `java-1_7_0-ibm >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-alsa >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-devel >= 1.7.0_sr7.0-0.5.1` `java-1_7_0-ibm-jdbc >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-plugin >= 1.7.0_sr4.2-0.6.1`	Patchnames: slessp2-java-1_6_0-ibm slessp2-java-1_7_0-ibm
SUSE Linux Enterprise Server for VMWare 11 SP3	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-alsa >= 1.6.0_sr16.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.3.1` `java-1_7_0-ibm >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-alsa >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-jdbc >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-plugin >= 1.7.0_sr4.2-0.6.1`	Patchnames: slessp3-java-1_6_0-ibm slessp3-java-1_7_0-ibm
SUSE Linux Enterprise Software Development Kit 11 SP2	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_7_0-ibm-devel >= 1.7.0_sr4.2-0.6.1`	Patchnames: sdksp2-java-1_6_0-ibm sdksp2-java-1_7_0-ibm
SUSE Linux Enterprise Software Development Kit 11 SP3	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_7_0-ibm-devel >= 1.7.0_sr4.2-0.6.1`	Patchnames: sdksp3-java-1_6_0-ibm sdksp3-java-1_7_0-ibm
SUSE Linux Enterprise Server 10 SP4 for x86	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-alsa >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.8.1`	Builds ZYPP Patch Nr: 8582
SUSE Linux Enterprise Server 10 SP4 for IBM POWER	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-64bit >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.8.1`	Builds ZYPP Patch Nr: 8582
SUSE Linux Enterprise Server 10 SP4 for IBM zSeries 64bit	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-32bit >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-devel-32bit >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.8.1`	Builds ZYPP Patch Nr: 8582
SUSE Linux Enterprise Server 10 SP4 for AMD64 and Intel EM64T	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-32bit >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-alsa-32bit >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-devel-32bit >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.8.1` `java-1_6_0-ibm-plugin-32bit >= 1.6.0_sr13.2-0.8.1`	Builds ZYPP Patch Nr: 8582
SUSE Linux Enterprise Software Development Kit 11 SP2	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1`	Builds SAT Patch Nr: 7744
SUSE Linux Enterprise Software Development Kit 11 SP2	`java-1_6_0-ibm-devel >= 1.6.0_sr13.2-0.3.1`	Builds SAT Patch Nr: 7744
SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-alsa >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.3.1`	Builds SAT Patch Nr: 7744
SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.3.1`	Builds SAT Patch Nr: 7744
SUSE Linux Enterprise Server 11 SP2	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.3.1`	Builds SAT Patch Nr: 7744
SUSE Linux Enterprise Software Development Kit 11 SP3	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-devel >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1`	Builds SAT Patch Nr: 7920
SUSE Linux Enterprise Software Development Kit 11 SP3	`java-1_6_0-ibm-devel >= 1.6.0_sr13.2-0.3.1`	Builds SAT Patch Nr: 7920
SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-alsa >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.3.1`	Builds SAT Patch Nr: 7920
SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-plugin >= 1.6.0_sr13.2-0.3.1`	Builds SAT Patch Nr: 7920
SUSE Linux Enterprise Server 11 SP3	`java-1_6_0-ibm >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-fonts >= 1.6.0_sr13.2-0.3.1` `java-1_6_0-ibm-jdbc >= 1.6.0_sr13.2-0.3.1`	Builds SAT Patch Nr: 7920
SUSE Linux Enterprise Software Development Kit 11 SP3	`java-1_7_0-ibm-devel >= 1.7.0_sr4.2-0.6.1`	Builds SAT Patch Nr: 7921
SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware	`java-1_7_0-ibm >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-alsa >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-jdbc >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-plugin >= 1.7.0_sr4.2-0.6.1`	Builds SAT Patch Nr: 7921
SUSE Linux Enterprise Server 11 SP3	`java-1_7_0-ibm >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-jdbc >= 1.7.0_sr4.2-0.6.1`	Builds SAT Patch Nr: 7921
SUSE Linux Enterprise Desktop 10 SP4 for x86	`java-1_5_0-ibm >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-alsa >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-demo >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-jdbc >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-plugin >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-src >= 1.5.0_sr16.2-0.5.1`	Builds ZYPP Patch Nr: 8593
SUSE Linux Enterprise Desktop 10 SP4 for AMD64 and Intel EM64T	`java-1_5_0-ibm >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-32bit >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-alsa-32bit >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-demo >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-devel-32bit >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-src >= 1.5.0_sr16.2-0.5.1`	Builds ZYPP Patch Nr: 8593
SUSE Linux Enterprise Server 10 SP4 for x86	`java-1_5_0-ibm >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-alsa >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-jdbc >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-plugin >= 1.5.0_sr16.2-0.5.1`	Builds ZYPP Patch Nr: 8593
SUSE Linux Enterprise Server 10 SP4 for IBM POWER	`java-1_5_0-ibm >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-64bit >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-jdbc >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-plugin >= 1.5.0_sr16.2-0.5.1`	Builds ZYPP Patch Nr: 8593
SUSE Linux Enterprise Server 10 SP4 for IBM zSeries 64bit	`java-1_5_0-ibm >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-32bit >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-devel-32bit >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.2-0.5.1`	Builds ZYPP Patch Nr: 8593
SUSE Linux Enterprise Server 10 SP4 for AMD64 and Intel EM64T	`java-1_5_0-ibm >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-32bit >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-alsa-32bit >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-devel >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-devel-32bit >= 1.5.0_sr16.2-0.5.1` `java-1_5_0-ibm-fonts >= 1.5.0_sr16.2-0.5.1`	Builds ZYPP Patch Nr: 8593
SUSE Linux Enterprise Software Development Kit 11 SP2	`java-1_7_0-ibm-devel >= 1.7.0_sr4.2-0.6.1`	Builds SAT Patch Nr: 7794
SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware	`java-1_7_0-ibm >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-alsa >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-jdbc >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-plugin >= 1.7.0_sr4.2-0.6.1`	Builds SAT Patch Nr: 7794
SUSE Linux Enterprise Server 11 SP2	`java-1_7_0-ibm >= 1.7.0_sr4.2-0.6.1` `java-1_7_0-ibm-jdbc >= 1.7.0_sr4.2-0.6.1`	Builds SAT Patch Nr: 7794
SUSE Linux Enterprise Desktop 11 SP2	`java-1_6_0-openjdk >= 1.6.0.0_b27.1.12.5-0.2.1` `java-1_6_0-openjdk-demo >= 1.6.0.0_b27.1.12.5-0.2.1` `java-1_6_0-openjdk-devel >= 1.6.0.0_b27.1.12.5-0.2.1`	Builds SAT Patch Nr: 7718
openSUSE 12.3	`java-1_7_0-openjdk >= 1.7.0.6-8.14.5` `java-1_7_0-openjdk-debuginfo >= 1.7.0.6-8.14.5` `java-1_7_0-openjdk-debugsource >= 1.7.0.6-8.14.5` `java-1_7_0-openjdk-demo >= 1.7.0.6-8.14.5` `java-1_7_0-openjdk-demo-debuginfo >= 1.7.0.6-8.14.5` `java-1_7_0-openjdk-devel >= 1.7.0.6-8.14.5` `java-1_7_0-openjdk-devel-debuginfo >= 1.7.0.6-8.14.5` `java-1_7_0-openjdk-javadoc >= 1.7.0.6-8.14.5` `java-1_7_0-openjdk-src >= 1.7.0.6-8.14.5`	Patchnames: openSUSE-2013-426
openSUSE Evergreen 11.4	`java-1_6_0-openjdk >= 1.6.0.0_b27.1.12.5-37.1` `java-1_6_0-openjdk-debuginfo >= 1.6.0.0_b27.1.12.5-37.1` `java-1_6_0-openjdk-debugsource >= 1.6.0.0_b27.1.12.5-37.1` `java-1_6_0-openjdk-demo >= 1.6.0.0_b27.1.12.5-37.1` `java-1_6_0-openjdk-demo-debuginfo >= 1.6.0.0_b27.1.12.5-37.1` `java-1_6_0-openjdk-devel >= 1.6.0.0_b27.1.12.5-37.1` `java-1_6_0-openjdk-devel-debuginfo >= 1.6.0.0_b27.1.12.5-37.1` `java-1_6_0-openjdk-javadoc >= 1.6.0.0_b27.1.12.5-37.1` `java-1_6_0-openjdk-src >= 1.6.0.0_b27.1.12.5-37.1`	Patchnames: 2013-74

CVE-2013-2422

Common Vulnerabilities and Exposures

Upstream information

Description

SUSE information

List of released packages

Services