CVE-2013-2465

CRITICAL
2013-06-18 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Mar 26, 2026 - 11:18 vuln.today
Patch Released
Oct 22, 2025 - 01:15 nvd
Patch available
PoC Detected
Oct 22, 2025 - 01:15 vuln.today
Public exploit code
Added to CISA KEV
Oct 22, 2025 - 01:15 cisa
CISA KEV
CVE Published
Jun 18, 2013 - 22:55 nvd
CRITICAL 9.8

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

Analysis

Oracle Java SE 7, 6, and 5 contain an unspecified vulnerability in the 2D graphics component that allows untrusted applets to escape the sandbox and execute arbitrary code, exploited by every major exploit kit in 2013.

Technical Context

The CWE-693 protection mechanism failure in Java's 2D rendering component allows a crafted applet to bypass the SecurityManager sandbox. While Oracle's advisory provides limited technical detail, the flaw involves improper access control checks in the graphics rendering pipeline.

Affected Products

['Oracle Java SE 7 Update 21 and earlier', 'Oracle Java SE 6 Update 45 and earlier', 'Oracle Java SE 5.0 Update 45 and earlier', 'OpenJDK 7']

Remediation

Remove Java browser plugins. Update Java if required for applications. Modern browsers have removed NPAPI/Java applet support entirely.

Priority Score

222
Low Medium High Critical
KEV: +50
EPSS: +93.2
CVSS: +49
POC: +20

Share

CVE-2013-2465 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy