CVE-2013-5893
Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK 7, allows...
Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to improper handling of methods in MethodHandles in HotSpot JVM, which allows attackers to escape the sandbox.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to improper handling of methods in MethodHandles in HotSpot JVM, which allows attackers to escape the sandbox.
- Record
CVE-2013-5893- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to improper handling of methods in MethodHandles in HotSpot JVM, which allows attackers to escape the sandbox.
- Record
CVE-2013-5893- Updated
- 2026-11-02
EUVDEUVD-2013-5727 No score
Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to improper handling of methods in MethodHandles in HotSpot JVM, which allows attackers to escape the sandbox.
- Record
EUVD-2013-5727- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q5hj-g9q3-fcqh No score
Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK 7, allows...
Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to improper handling of methods in MethodHandles in HotSpot JVM, which allows attackers to escape the sandbox.
- Record
GHSA-q5hj-g9q3-fcqh- Updated
- 2026-11-02
OSVMGASA-2014-0023 No score
Updated java-1.7.0-openjdk package fixes multiple security vulnerabilities
Updated java-1.7.0-openjdk packages fix security vulnerabilities:
An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions (CVE-2013-5907).
Multiple improper permission check issues were discovered in the CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2014-0428, CVE-2014-0422, CVE-2013-5893).
Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions (CVE-2014-0373, CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376, CVE-2014-0368).
It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability (CVE-2014-0423).
It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to disclosure of information about the used encryption keys (CVE-2014-0411).
- Record
MGASA-2014-0023- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10534-1 No score
java-1_7_0-openjdk-1.7.0.121-1.1 on GA media
These are all security issues fixed in the java-1_7_0-openjdk-1.7.0.121-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10534-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0336-1 No score
Security update for Java OpenJDK
Oracle Critical Patch Update Advisory - October 2014
Description:
A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities.
Find more information here: http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- Record
SUSE-SU-2015:0336-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0833-1 No score
Security update for Java OpenJDK
Oracle Critical Patch Update Advisory - October 2014
Description:
A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities.
Find more information here: http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- Record
SUSE-SU-2015:0833-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.7.0-openjdkMageia:3 From an advisory covering 14 CVEs |
before 1.7.0.60-2.4.4.1.mga3 | 1.7.0.60-2.4.4.1.mga3 |
java-1.7.0-openjdkRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-develRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdkRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
Show 46 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.7.0-openjdk-develRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdkRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-develRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdkRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-develRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el6_5 | 1:1.7.0.51-2.4.4.1.el6_5 |
java-1.7.0-openjdkRed Hat:enterprise_linux:5::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:5::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdk-develRed Hat:enterprise_linux:5::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:5::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:5::client From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdkRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdk-develRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 1:1.7.0.51-2.4.4.1.el5_10 | 1:1.7.0.51-2.4.4.1.el5_10 |
java-1.7.0-oracleRed Hat:rhel_extras:5::client From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracle-develRed Hat:rhel_extras:5::client From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracle-javafxRed Hat:rhel_extras:5::client From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracle-jdbcRed Hat:rhel_extras:5::client From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracle-pluginRed Hat:rhel_extras:5::client From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracle-srcRed Hat:rhel_extras:5::client From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracleRed Hat:rhel_extras:5::server From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracle-develRed Hat:rhel_extras:5::server From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracle-javafxRed Hat:rhel_extras:5::server From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracle-jdbcRed Hat:rhel_extras:5::server From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracle-pluginRed Hat:rhel_extras:5::server From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracle-srcRed Hat:rhel_extras:5::server From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el5_10 | 1:1.7.0.51-1jpp.1.el5_10 |
java-1.7.0-oracleRed Hat:rhel_extras:6 From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el6_5 | 1:1.7.0.51-1jpp.1.el6_5 |
java-1.7.0-oracle-develRed Hat:rhel_extras:6 From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el6_5 | 1:1.7.0.51-1jpp.1.el6_5 |
java-1.7.0-oracle-javafxRed Hat:rhel_extras:6 From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el6_5 | 1:1.7.0.51-1jpp.1.el6_5 |
java-1.7.0-oracle-jdbcRed Hat:rhel_extras:6 From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el6_5 | 1:1.7.0.51-1jpp.1.el6_5 |
java-1.7.0-oracle-pluginRed Hat:rhel_extras:6 From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el6_5 | 1:1.7.0.51-1jpp.1.el6_5 |
java-1.7.0-oracle-srcRed Hat:rhel_extras:6 From an advisory covering 35 CVEs |
before 1:1.7.0.51-1jpp.1.el6_5 | 1:1.7.0.51-1jpp.1.el6_5 |
java-1_7_0-openjdkopenSUSE:Tumbleweed From an advisory covering 304 CVEs |
before 1.7.0.121-1.1 | 1.7.0.121-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-5893 is a high vulnerability (CVSS 9.3) in Oracle Jdk, published January 15, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.26%, the 92nd percentile. No source names a fixed version.
References
secunia.com/advisories/56432
lists.opensuse.org/opensuse-updates/2014-01/msg00105.html
hg.openjdk.java.net/jdk7u/jdk7u/hotspot/rev/839100e42498
ubuntu.com/usn/USN-2089-1
osvdb.org/102000
Show 194 moreShow less
rhn.redhat.com/errata/RHSA-2014-0030.html
marc.info?l=bugtraq&m=139402697611681&w=2
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777
securitytracker.com/id/1029608
bugzilla.redhat.com/show_bug.cgi?id=1051549
securityfocus.com/bid/64863
oracle.com/technetwork/topics/security/cpujan2014-1972949.html
nvd.nist.gov/vuln/detail/CVE-2013-5893
github.com/advisories/GHSA-q5hj-g9q3-fcqh
advisories.mageia.org/MGASA-2014-0023.html
mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-January/025800.html
bugs.mageia.org/show_bug.cgi?id=12317
access.redhat.com/errata/RHSA-2014:0026
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0026.json
cve.org/CVERecord?id=CVE-2013-4578
suse.com/support/update/announcement/2015/suse-su-20150336-1
bugzilla.suse.com/828665
Left out here: 312 references. The JSON record has them.