CVEs / CVE-2013-2465

CVE-2013-2465: Oracle Java SE Unspecified Vulnerability

Known exploited in the CISA KEV catalog since 28 Mar 2022
high 10 CVSS 2.0 (NVD)
EPSS 98.7% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
Last changed at its sources 16 Jun 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2013-2465

Summary

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D
CISA, Known Exploited Vulnerabilities catalog

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
The CVE record, via NVD · published 18 Jun 2013 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
n/a n/a	n/a	—

Exploitation

In CISA KEV since	28 Mar 2022
Due date for US federal agencies	18 Apr 2022
Used in ransomware campaigns	Known
Required action	Apply updates per vendor instructions.

Severity

CVSS 2.0	10 high `AV:N/AC:L/Au:N/C:C/I:C/A:C` Scored by NVD
Weakness	CWE-693

References

CVE-2013-2465 on NVD
CVE-2013-2465 in the CISA KEV catalog
http://advisories.mageia.org/MGASA-2013-0185.html Broken Link
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880 Broken Link
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040 Patch
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=137545505800971&w=2 Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=137545592101387&w=2 Mailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0963.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1059.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1060.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1081.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1455.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1456.html Third Party Advisory
http://secunia.com/advisories/54154 Not Applicable
http://security.gentoo.org/glsa/glsa-201406-32.xml Third Party Advisory

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.