Every CVE Search/ Get API key

CVE-2013-2460

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7...

9.3 HighPublic exploit

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.

Exploit likelihood

70.0%Down 16.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.

Record
CVE-2013-2460
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE List No score

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.

Record
CVE-2013-2460
Updated
2026-11-02
EUVDEUVD-2013-2406 No score

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.

Record
EUVD-2013-2406
Updated
2026-11-03
GitHub AdvisoriesGHSA-fmcw-8c9j-mwj4 No score

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7...

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.

Record
GHSA-fmcw-8c9j-mwj4
Updated
2026-11-02
OSVMGASA-2013-0185 No score

Updated java-1.7.0-openjdk packages fix multiple security vulnerabilities

Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption (CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-2463, CVE-2013-2465, CVE-2013-2469).

Integer overflow flaws were found in the way AWT processed certain input. An attacker could use these flaws to execute arbitrary code with the privileges of the user running an untrusted Java applet or application (CVE-2013-2459).

Multiple improper permission check issues were discovered in the Sound, JDBC, Libraries, JMX, and Serviceability components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2013-2448, CVE-2013-2454, CVE-2013-2458, CVE-2013-2457, CVE-2013-2453, CVE-2013-2460).

Multiple flaws in the Serialization, Networking, Libraries and CORBA components can be exploited by an untrusted Java application or applet to gain access to potentially sensitive information (CVE-2013-2456, CVE-2013-2447, CVE-2013-2455, CVE-2013-2452, CVE-2013-2443, CVE-2013-2446).

It was discovered that the Hotspot component did not properly handle out-of-memory errors. An untrusted Java application or applet could possibly use these flaws to terminate the Java Virtual Machine (CVE-2013-2445).

It was discovered that the AWT component did not properly manage certain resources and that the ObjectStreamClass of the Serialization component did not properly handle circular references. An untrusted Java application or applet could possibly use these flaws to cause a denial of service (CVE-2013-2444, CVE-2013-2450).

It was discovered that the Libraries component contained certain errors related to XML security and the class loader. A remote attacker could possibly exploit these flaws to bypass intended security mechanisms or disclose potentially sensitive information and cause a denial of service (CVE-2013-2407, CVE-2013-2461).

It was discovered that JConsole did not properly inform the user when establishing an SSL connection failed. An attacker could exploit this flaw to gain access to potentially sensitive information (CVE-2013-2412).

It was discovered that GnomeFileTypeDetector did not check for read permissions when accessing files. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information (CVE-2013-2449).

It was found that documentation generated by Javadoc was vulnerable to a frame injection attack. If such documentation was accessible over a network, and a remote attacker could trick a user into visiting a specially-crafted URL, it would lead to arbitrary web content being displayed next to the documentation. This could be used to perform a phishing attack by providing frame content that spoofed a login form on the site hosting the vulnerable documentation (CVE-2013-1571).

It was discovered that the 2D component created shared memory segments with insecure permissions. A local attacker could use this flaw to read or write to the shared memory segment (CVE-2013-1500).

Additionally, this OpenJDK update causes icedtea-web, the Java browser plugin, to crash, so icedtea-web has been patched to fix this on Mageia 3.

Note that on Mageia 2, icedtea-web uses java-1.6.0-openjdk, which has not yet been updated to fix these security issues. An ETA for that update is not known at this time.

Record
MGASA-2013-0185
Updated
2026-11-02
OSVopenSUSE-SU-2024:10534-1 No score

java-1_7_0-openjdk-1.7.0.121-1.1 on GA media

These are all security issues fixed in the java-1_7_0-openjdk-1.7.0.121-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10534-1
Updated
2026-11-02
Show 6 moreShow less
OSVSUSE-SU-2015:0336-1 No score

Security update for Java OpenJDK

Oracle Critical Patch Update Advisory - October 2014

Description:

A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities.

Find more information here: http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Record
SUSE-SU-2015:0336-1
Updated
2026-11-02
OSVSUSE-SU-2015:0343-1 No score

Security update for IBM Java

java-1_7_0-ibm has been updated to version 1.7.0_sr7.2 to fix 21 security issues.

These security issues have been fixed:

* Unspecified vulnerability (CVE-2014-3065).
* The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
  products, uses nondeterministic CBC padding, which makes it easier
  for man-in-the-middle attackers to obtain cleartext data via a
  padding-oracle attack, aka the 'POODLE' issue (CVE-2014-3566).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and
  Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via vectors related to
  AWT (CVE-2014-6513).
* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows
  remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors (CVE-2014-6456).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532
  (CVE-2014-6503).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503
  (CVE-2014-6532).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-4288).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-6493).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Firefox, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6492).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows local users to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment
  (CVE-2014-6458).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Internet Explorer, allows local users to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6466).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Libraries (CVE-2014-6506).
* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows
  remote attackers to affect integrity via unknown vectors related to
  Deployment, a different vulnerability than CVE-2014-6527
  (CVE-2014-6476).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect integrity via unknown vectors
  related to Deployment (CVE-2014-6515).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20 allows remote attackers to affect confidentiality via unknown
  vectors related to 2D (CVE-2014-6511).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality via unknown vectors related to Libraries
  (CVE-2014-6531).
* Unspecified…
Record
SUSE-SU-2015:0343-1
Updated
2026-11-02
OSVSUSE-SU-2015:0344-1 No score

Security update for IBM Java 7

IBM Java 7 SR6 has been released and fixes lots of bugs and security issues.

More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ http://www.ibm.com/developerworks/java/jdk/alerts/

Security Issue references:

* CVE-2013-5458
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5458>
* CVE-2013-5456
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5456>
* CVE-2013-5457
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5457>
* CVE-2013-4041
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4041>
* CVE-2013-5375
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5375>
* CVE-2013-5372
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5372>
* CVE-2013-5843
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5843>
* CVE-2013-5789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5789>
* CVE-2013-5830
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5830>
* CVE-2013-5829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5829>
* CVE-2013-5787
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5787>
* CVE-2013-5788
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5788>
* CVE-2013-5824
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5824>
* CVE-2013-5842
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5842>
* CVE-2013-5782
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5782>
* CVE-2013-5817
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5817>
* CVE-2013-5809
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5809>
* CVE-2013-5814
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5814>
* CVE-2013-5832
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5832>
* CVE-2013-5850
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5850>
* CVE-2013-5838
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5838>
* CVE-2013-5802
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5802>
* CVE-2013-5812
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5812>
* CVE-2013-5804
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5804>
* CVE-2013-5783
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5783>
* CVE-2013-3829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3829>
* CVE-2013-5823
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5823>
* CVE-2013-5831
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5831>
* CVE-2013-5820
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5820>
* CVE-2013-5819
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5819>
* CVE-2013-5818
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5818>
* CVE-2013-5848
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5848>
* CVE-2013-5776
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5776>
* CVE-2013-5774
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5774>
* CVE-2013-5825
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5825>
* CVE-2013-5840
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5840>
* CVE-2013-5801
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5801>
* CVE-2013-5778
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5778>
* CVE-2013-5851
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5851>
* CVE-2013-5800
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5800>
* CVE-2013-5784
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5784>
* CVE-2013-5849
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5849>
* CVE-2013-5790
 …
Record
SUSE-SU-2015:0344-1
Updated
2026-11-02
OSVSUSE-SU-2015:0833-1 No score

Security update for Java OpenJDK

Oracle Critical Patch Update Advisory - October 2014

Description:

A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities.

Find more information here: http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Record
SUSE-SU-2015:0833-1
Updated
2026-11-02
OSVSUSE-SU-2015:1086-3 No score

Security update for IBM Java 7

IBM Java 7 SR6 has been released and fixes lots of bugs and security issues.

More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ http://www.ibm.com/developerworks/java/jdk/alerts/

Security Issue references:

* CVE-2013-5458
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5458>
* CVE-2013-5456
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5456>
* CVE-2013-5457
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5457>
* CVE-2013-4041
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4041>
* CVE-2013-5375
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5375>
* CVE-2013-5372
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5372>
* CVE-2013-5843
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5843>
* CVE-2013-5789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5789>
* CVE-2013-5830
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5830>
* CVE-2013-5829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5829>
* CVE-2013-5787
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5787>
* CVE-2013-5788
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5788>
* CVE-2013-5824
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5824>
* CVE-2013-5842
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5842>
* CVE-2013-5782
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5782>
* CVE-2013-5817
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5817>
* CVE-2013-5809
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5809>
* CVE-2013-5814
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5814>
* CVE-2013-5832
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5832>
* CVE-2013-5850
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5850>
* CVE-2013-5838
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5838>
* CVE-2013-5802
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5802>
* CVE-2013-5812
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5812>
* CVE-2013-5804
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5804>
* CVE-2013-5783
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5783>
* CVE-2013-3829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3829>
* CVE-2013-5823
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5823>
* CVE-2013-5831
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5831>
* CVE-2013-5820
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5820>
* CVE-2013-5819
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5819>
* CVE-2013-5818
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5818>
* CVE-2013-5848
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5848>
* CVE-2013-5776
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5776>
* CVE-2013-5774
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5774>
* CVE-2013-5825
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5825>
* CVE-2013-5840
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5840>
* CVE-2013-5801
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5801>
* CVE-2013-5778
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5778>
* CVE-2013-5851
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5851>
* CVE-2013-5800
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5800>
* CVE-2013-5784
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5784>
* CVE-2013-5849
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5849>
* CVE-2013-5790
 …
Record
SUSE-SU-2015:1086-3
Updated
2026-11-02
OSVSUSE-SU-2015:1086-4 No score

Security update for IBM Java

java-1_7_0-ibm has been updated to version 1.7.0_sr7.2 to fix 21 security issues.

These security issues have been fixed:

* Unspecified vulnerability (CVE-2014-3065).
* The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
  products, uses nondeterministic CBC padding, which makes it easier
  for man-in-the-middle attackers to obtain cleartext data via a
  padding-oracle attack, aka the 'POODLE' issue (CVE-2014-3566).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and
  Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via vectors related to
  AWT (CVE-2014-6513).
* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows
  remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors (CVE-2014-6456).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532
  (CVE-2014-6503).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503
  (CVE-2014-6532).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-4288).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-6493).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Firefox, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6492).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows local users to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment
  (CVE-2014-6458).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Internet Explorer, allows local users to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6466).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Libraries (CVE-2014-6506).
* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows
  remote attackers to affect integrity via unknown vectors related to
  Deployment, a different vulnerability than CVE-2014-6527
  (CVE-2014-6476).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect integrity via unknown vectors
  related to Deployment (CVE-2014-6515).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20 allows remote attackers to affect confidentiality via unknown
  vectors related to 2D (CVE-2014-6511).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality via unknown vectors related to Libraries
  (CVE-2014-6531).
* Unspecified…
Record
SUSE-SU-2015:1086-4
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openjdk-7
Debian:7
From an advisory covering 30 CVEs
 before 7u25-2.3.10-1~deb7u1, plus listed versions
7u13-2.3.6-17u15-2.3.7-17u17-2.3.8-17u17-2.3.8-27u21-2.3.9-1
Show 11 moreShow less
7u21-2.3.9-27u21-2.3.9-37u21-2.3.9-47u21-2.3.9-57u21-2.3.9-5+powerpcspe17u3-2.1.7-17u7-2.3.2-17u7-2.3.2a-17u9-2.3.3-17u9-2.3.4-17u9-2.3.5~pre1-1
7u25-2.3.10-1~deb7u1
java-1.7.0-openjdk
Mageia:2
From an advisory covering 29 CVEs
 before 1.7.0.25-2.3.10.1.mga2
1.7.0.25-2.3.10.1.mga2
java-1.7.0-openjdk
Mageia:3
From an advisory covering 29 CVEs
 before 1.7.0.25-2.3.10.1.mga3
1.7.0.25-2.3.10.1.mga3
icedtea-web
Mageia:3
From an advisory covering 29 CVEs
 before 1.3.2-1.1.mga3
1.3.2-1.1.mga3
java-1.7.0-openjdk
Red Hat:enterprise_linux:6::client
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-demo
Red Hat:enterprise_linux:6::client
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-javadoc
Red Hat:enterprise_linux:6::client
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-src
Red Hat:enterprise_linux:6::client
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
Show 49 moreShow less
Affected packages
PackageAffectedFixed
java-1.7.0-openjdk
Red Hat:enterprise_linux:6::computenode
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-demo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-javadoc
Red Hat:enterprise_linux:6::computenode
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-src
Red Hat:enterprise_linux:6::computenode
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk
Red Hat:enterprise_linux:6::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-demo
Red Hat:enterprise_linux:6::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-javadoc
Red Hat:enterprise_linux:6::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-src
Red Hat:enterprise_linux:6::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk
Red Hat:enterprise_linux:6::workstation
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-demo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-javadoc
Red Hat:enterprise_linux:6::workstation
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk-src
Red Hat:enterprise_linux:6::workstation
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.3.el6_4
1:1.7.0.25-2.3.10.3.el6_4
java-1.7.0-openjdk
Red Hat:enterprise_linux:5::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.4.el5_9
1:1.7.0.25-2.3.10.4.el5_9
java-1.7.0-openjdk-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.4.el5_9
1:1.7.0.25-2.3.10.4.el5_9
java-1.7.0-openjdk-demo
Red Hat:enterprise_linux:5::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.4.el5_9
1:1.7.0.25-2.3.10.4.el5_9
java-1.7.0-openjdk-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.4.el5_9
1:1.7.0.25-2.3.10.4.el5_9
java-1.7.0-openjdk-javadoc
Red Hat:enterprise_linux:5::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.4.el5_9
1:1.7.0.25-2.3.10.4.el5_9
java-1.7.0-openjdk-src
Red Hat:enterprise_linux:5::server
From an advisory covering 29 CVEs
 before 1:1.7.0.25-2.3.10.4.el5_9
1:1.7.0.25-2.3.10.4.el5_9
java-1.7.0-oracle
Red Hat:rhel_extras:5::server
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el5_9
1:1.7.0.25-1jpp.1.el5_9
java-1.7.0-oracle-devel
Red Hat:rhel_extras:5::server
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el5_9
1:1.7.0.25-1jpp.1.el5_9
java-1.7.0-oracle-javafx
Red Hat:rhel_extras:5::server
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el5_9
1:1.7.0.25-1jpp.1.el5_9
java-1.7.0-oracle-jdbc
Red Hat:rhel_extras:5::server
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el5_9
1:1.7.0.25-1jpp.1.el5_9
java-1.7.0-oracle-plugin
Red Hat:rhel_extras:5::server
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el5_9
1:1.7.0.25-1jpp.1.el5_9
java-1.7.0-oracle-src
Red Hat:rhel_extras:5::server
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el5_9
1:1.7.0.25-1jpp.1.el5_9
java-1.7.0-oracle
Red Hat:rhel_extras:6
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el6_4
1:1.7.0.25-1jpp.1.el6_4
java-1.7.0-oracle-devel
Red Hat:rhel_extras:6
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el6_4
1:1.7.0.25-1jpp.1.el6_4
java-1.7.0-oracle-javafx
Red Hat:rhel_extras:6
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el6_4
1:1.7.0.25-1jpp.1.el6_4
java-1.7.0-oracle-jdbc
Red Hat:rhel_extras:6
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el6_4
1:1.7.0.25-1jpp.1.el6_4
java-1.7.0-oracle-plugin
Red Hat:rhel_extras:6
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el6_4
1:1.7.0.25-1jpp.1.el6_4
java-1.7.0-oracle-src
Red Hat:rhel_extras:6
From an advisory covering 38 CVEs
 before 1:1.7.0.25-1jpp.1.el6_4
1:1.7.0.25-1jpp.1.el6_4
java-1.7.0-ibm
Red Hat:rhel_extras:5::server
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el5_9
1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-demo
Red Hat:rhel_extras:5::server
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el5_9
1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-devel
Red Hat:rhel_extras:5::server
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el5_9
1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-jdbc
Red Hat:rhel_extras:5::server
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el5_9
1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-plugin
Red Hat:rhel_extras:5::server
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el5_9
1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-src
Red Hat:rhel_extras:5::server
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el5_9
1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm
Red Hat:rhel_extras:6
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el6_4
1:1.7.0.5.0-1jpp.2.el6_4
java-1.7.0-ibm-demo
Red Hat:rhel_extras:6
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el6_4
1:1.7.0.5.0-1jpp.2.el6_4
java-1.7.0-ibm-devel
Red Hat:rhel_extras:6
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el6_4
1:1.7.0.5.0-1jpp.2.el6_4
java-1.7.0-ibm-jdbc
Red Hat:rhel_extras:6
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el6_4
1:1.7.0.5.0-1jpp.2.el6_4
java-1.7.0-ibm-plugin
Red Hat:rhel_extras:6
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el6_4
1:1.7.0.5.0-1jpp.2.el6_4
java-1.7.0-ibm-src
Red Hat:rhel_extras:6
From an advisory covering 43 CVEs
 before 1:1.7.0.5.0-1jpp.2.el6_4
1:1.7.0.5.0-1jpp.2.el6_4
java-1_7_0-openjdk
openSUSE:Tumbleweed
From an advisory covering 304 CVEs
 before 1.7.0.121-1.1
1.7.0.121-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitJava Applet ProviderSkeleton Insecure Invoke Method2013-06-18
Exploit-DBJava Applet - ProviderSkeleton Insecure Invoke Method (Metasploit)2013-07-01

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2460 is a high vulnerability (CVSS 9.3) in Oracle Jdk, published June 18, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 70.0%, the 99th percentile. No source names a fixed version.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 480 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open