CVE DatabaseCVE-2013-2465

Updated 2026-06-16한국어 권고문 →

CVE-2013-24659.8/CRITICALCISA KEVCWE-693

Oracle Java SE and OpenJDK 2D Graphics Sandbox Escape and Remote Code Execution Vulnerability (CVE-2013-2465)

⚡ Jump to Patch

Affected Vendors

oracle, openjdk

Affected Components

java_se, jre, openjdk

Published Date

2013-06-18

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

98.8%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, 5.0 Update 45 and earlier, and OpenJDK 7.

Impact

Remote attackers can completely bypass the Java security sandbox and execute arbitrary code on the host system via malicious 2D image rendering.

Mitigation

Immediately upgrade to Java SE 7u25 or later, apply OpenJDK security patches, and disable Java browser plugins.

Affected Products & Version Scope

Oracle Java SE 7u21 and earlier, 6u45 and earlier, 5.0u45 and earlier, and OpenJDK 7

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Upgrade your Java Runtime Environment to the latest secure versions. Use the following commands to update OpenJDK on Linux distributions:

bash

# For Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get install --only-upgrade -y openjdk-7-jre openjdk-7-jdk

# For RHEL/CentOS-based systems
sudo yum update -y java-1.7.0-openjdk

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, disable the Java browser plugin to mitigate web-based attack vectors, and enforce strict deployment security levels.

bash

# Remove Java Plugin symbolic links for Firefox on Linux
rm -f ~/.mozilla/plugins/libnpjp2.so
sudo rm -f /usr/lib/firefox/plugins/libnpjp2.so

# Enforce high security settings in Java deployment properties
echo 'deployment.security.level=VERY_HIGH' >> ~/.java/deployment/deployment.properties
echo 'deployment.security.askgrantdialog.show=false' >> ~/.java/deployment/deployment.properties

3. Log Audit & IoC Verification Commands

Verify the active Java version and inspect web server access logs for suspicious requests targeting Java applets.

bash

# Check the current active Java version
java -version

# Scan web server access logs for unusual requests targeting .jar or .class files
grep -E '\.(jar|class)\?' /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active exploitation history (CISA KEV), immediately upgrade all JRE/JDK installations to patched versions and disable legacy browser-based Java plugins.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability exists within the 2D graphics subsystem of the Oracle Java Runtime Environment (JRE) and OpenJDK. The root cause is a logical flaw in the image channel verification mechanism when processing raster images. The Java 2D component fails to properly validate the relationship between the number of image channels and the allocated buffer size, leading to out-of-bounds memory access and corruption.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by hosting a specially crafted Java applet on a malicious website or distributing a malicious Java application. When a victim visits the site, the applet triggers the Java 2D API to render an image with an inconsistent channel layout. This corrupts the internal memory structures of the JVM, allowing the attacker to bypass the Java sandbox restrictions and execute arbitrary native code with the privileges of the running JVM process.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability represents a severe threat vector. Successful exploitation grants full control over the affected endpoint or server, potentially leading to lateral movement within the enterprise network, data exfiltration, or ransomware deployment.

Official Vendor Advisories & References

NVD Original English Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

http://advisories.mageia.org/MGASA-2013-0185.html

Source: secalert_us@oracle.com · Broken Link

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880

Source: secalert_us@oracle.com · Broken Link

http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040

Source: secalert_us@oracle.com · Patch

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html

Source: secalert_us@oracle.com · Mailing List, Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html

Source: secalert_us@oracle.com · Mailing List, Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html

Source: secalert_us@oracle.com · Mailing List, Third Party Advisory

Frequently Asked SecOps Questions (CVE-2013-2465)

FAQ

Q1. How critical is CVE-2013-2465 and is it actively exploited in the wild?

CVE-2013-2465 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 98.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2013-2465?

Primary impacted vendors include oracle, openjdk across java_se, jre, openjdk. Scope summary: Oracle Java SE 7u21 and earlier, 6u45 and earlier, 5.0u45 and earlier, and OpenJDK 7

Q3. What temporary mitigations or workarounds exist for CVE-2013-2465 before patching?

[Mitigation] Immediately upgrade to Java SE 7u25 or later, apply OpenJDK security patches, and disable Java browser plugins. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION