# CVE-2013-2423: Oracle JRE Unspecified Vulnerability

> CVE-2013-2423: Oracle JRE Unspecified Vulnerability. CVSS 3.7 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2013-2423
Last updated: 2025-10-22T00:05:43Z

- Published: 2013-04-17 15:00 UTC · Updated: 2025-10-22 00:05 UTC · Assigner: oracle
- CVSS: 3.7 (CVSS 3.1) · Severity: Low · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS: 85.2%, 100th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2022-05-25, federal due date 2022-06-15, ransomware use: Unknown

## Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

## CISA required action

Apply updates per vendor instructions.

## Affected vendors and products

- Oracle: Java Runtime Environment (JRE)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2013-2423)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2013-2423)
- [http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/](http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/)
- [http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html](http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html)
- [http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f](http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f)
- [http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html](http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html)
- [http://rhn.redhat.com/errata/RHSA-2013-0752.html](http://rhn.redhat.com/errata/RHSA-2013-0752.html)
- [http://rhn.redhat.com/errata/RHSA-2013-0757.html](http://rhn.redhat.com/errata/RHSA-2013-0757.html)
- [https://bugzilla.redhat.com/show\_bug.cgi?id=952398](https://bugzilla.redhat.com/show_bug.cgi?id=952398)
- [http://security.gentoo.org/glsa/glsa-201406-32.xml](http://security.gentoo.org/glsa/glsa-201406-32.xml)
- [https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16700](https://oval.cisecurity.org/repository/search/definition/oval%253Aorg.mitre.oval%253Adef%253A16700)
- [https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130](https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130)
- [http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0](http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0)
- [http://www.exploit-db.com/exploits/24976](http://www.exploit-db.com/exploits/24976)
- [http://www.mandriva.com/security/advisories?name=MDVSA-2013:161](http://www.mandriva.com/security/advisories?name=MDVSA-2013:161)
- [http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html](http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html)
- [http://www.ubuntu.com/usn/USN-1806-1](http://www.ubuntu.com/usn/USN-1806-1)
- [http://www.us-cert.gov/ncas/alerts/TA13-107A](http://www.us-cert.gov/ncas/alerts/TA13-107A)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2013-2423 · Markdown: https://rewindex.com/cve/CVE-2013-2423.md · JSON: https://rewindex.com/api/v1/cves/CVE-2013-2423 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:46:49.088Z