‹ Volver al listado

CVE-2013-0401

Estado: ModificadaAlta (10)—
Gravedad10Alta · CVSS 2.0
Probabilidad de explotación10 %mayor que el 96 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

El componente Java Runtime Environment (JRE) en Java SE versión 7 Update 17 y anteriores, versión 6 Update 43 y anteriores, y versión 5.0 Update 41 y anteriores; y OpenJDK versiones 6 y 7 de Oracle; permite a los atacantes remotos ejecutar código arbitrario por medio de vectores relacionados a AWT, como fue demostrado por Ben Murphy durante una competencia Pwn2Own en CanSecWest 2013. NOTA: la información anterior es de la CPU de abril de 2013. Oracle no ha comentado sobre las afirmaciones de otro proveedor de que este problema está relacionado a la invocación del cargador de clases del sistema por la clase sun.awt.datatransfer.ClassLoaderObjectInputStream, que permite a los atacantes remotos omitirlas restricciones del sandbox de Java.

CVSS

Puntuación base
10
Versión
2.0
Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
10 %
Percentil entre todas las CVEs puntuadas
96
Fecha de la puntuación
21/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Oracle — JDKOracle — JRE

CWE

Referencias

Mostrar las 62 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-0401",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-03-08T18:55:01.553",
  "references": [
    {
      "url": "http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/31c782610044",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00013.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00001.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=137283787217316&w=2",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0752.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0757.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0758.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:145",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:161",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1806-1",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-107A",
      "tags": [
        "US Government Resource"
      ],
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=920245",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16297",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19463",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19641",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://twitter.com/thezdi/status/309784608508100608",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/31c782610044",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00013.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=137283787217316&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0752.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0757.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0758.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:145",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:161",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1806-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-107A",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=920245",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16297",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19463",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19641",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://twitter.com/thezdi/status/309784608508100608",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions."
    },
    {
      "lang": "es",
      "value": "El componente Java Runtime Environment (JRE) en Java SE versión 7 Update 17 y anteriores, versión 6 Update 43 y anteriores, y versión 5.0 Update 41 y anteriores; y OpenJDK versiones 6 y 7 de Oracle; permite a los atacantes remotos ejecutar código arbitrario por medio de vectores relacionados a AWT, como fue demostrado por Ben Murphy durante una competencia Pwn2Own en CanSecWest 2013. NOTA: la información anterior es de la CPU de abril de 2013. Oracle no ha comentado sobre las afirmaciones de otro proveedor de que este problema está relacionado a la invocación del cargador de clases del sistema por la clase sun.awt.datatransfer.ClassLoaderObjectInputStream, que permite a los atacantes remotos omitirlas restricciones del sandbox de Java."
    }
  ],
  "lastModified": "2026-06-16T23:49:22.457",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "130849CD-A581-4FE6-B2AA-99134F16FE65"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37B5B98B-0E41-4397-8AB0-C18C6F10AED1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com"
}