CVE-2013-1491 Code injection in n/a

Critical 10.0 Published 8 Mar 2013 Updated 6 Aug 2024

Remote attackers can execute arbitrary code via Java 2D vectors, requiring user interaction to view malicious content.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2013-1491?

CVE-2013-1491 is a critical code injection vulnerability in Oracle Jdk, published on 8 Mar 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013.

Weakness: CWE-94

Which versions are affected by CVE-2013-1491?

It affects 2 products.

Products include Oracle Jdk, Oracle Jre.

How do I fix CVE-2013-1491?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2013-1491 being exploited?

There is no known exploitation of CVE-2013-1491 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Oracle Jdk vulnerabilities

Sources

Also known as GHSA-w2h9-vx32-mw67.