{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka \"Issue 51,\" a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2013-01-31T14:10:00Z", "orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717"}, {"name": "20130118 [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2013/Jan/142"}, {"tags": ["x_refsource_MISC"], "url": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/"}, {"name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2013/Jan/195"}, {"tags": ["x_refsource_MISC"], "url": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53"}, {"name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/525387/30/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2013-1490", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka \"Issue 51,\" a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717", "refsource": "MISC", "url": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717"}, {"name": "20130118 [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2013/Jan/142"}, {"name": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/", "refsource": "MISC", "url": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/"}, {"name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2013/Jan/195"}, {"name": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53", "refsource": "MISC", "url": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53"}, {"name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/525387/30/0/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T15:04:48.850Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717"}, {"name": "20130118 [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2013/Jan/142"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/"}, {"name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2013/Jan/195"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53"}, {"name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/525387/30/0/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "assignerShortName": "oracle", "cveId": "CVE-2013-1490", "datePublished": "2013-01-31T14:10:00Z", "dateReserved": "2013-01-30T00:00:00Z", "dateUpdated": "2024-09-16T16:38:10.401Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*", "matchCriteriaId": "30B480BC-0886-4B19-B0A5-57B531077F40", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*", "matchCriteriaId": "B2B20041-EB5D-4FA4-AC7D-C35E7878BCFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka \"Issue 51,\" a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability."}, {"lang": "es", "value": "Vulnerabilidad no especificada en Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) permite a atacantes remotos asistidos por el usuario evitar el recinto de seguridad de Java (Sandbox) a trav\u00e9s de vectores no especificados, tambi\u00e9n conocido como \"Problema 51\", una vulnerabilidad diferente a CVE-2013-0431. NOTA: a partir de 20130130, esta vulnerabilidad no contiene ning\u00fan detalle independientemente verificables, y no hay un reconocimiento de proveedores. Un identificador CVE se asigna a esta vulnerabilidad por que ha recibido una considerable atenci\u00f3n del p\u00fablico, y el investigador original tiene un historial establecido de emisi\u00f3n de informes de vulnerabilidades que han sido corregidos por los proveedores. NOTA: este problema tambi\u00e9n existe en la SE 6, pero no puede ser explotada sin una vulnerabilidad independiente."}], "id": "CVE-2013-1490", "lastModified": "2024-11-21T01:49:42.910", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2013-01-31T14:55:01.967", "references": [{"source": "secalert_us@oracle.com", "url": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/"}, {"source": "secalert_us@oracle.com", "url": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53"}, {"source": "secalert_us@oracle.com", "url": "http://seclists.org/fulldisclosure/2013/Jan/142"}, {"source": "secalert_us@oracle.com", "url": "http://seclists.org/fulldisclosure/2013/Jan/195"}, {"source": "secalert_us@oracle.com", "url": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717"}, {"source": "secalert_us@oracle.com", "url": "http://www.securityfocus.com/archive/1/525387/30/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2013/Jan/142"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2013/Jan/195"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/525387/30/0/threaded"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "JDK: complete Java security sandbox bypass (Issue 51)", "id": "906450", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906450"}, "csaw": false, "cvss": {"cvss_base_score": "6.8", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "status": "draft"}, "details": ["Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka \"Issue 51,\" a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability."], "name": "CVE-2013-1490", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "java-1.6.0-openjdk", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "java-1.6.0-sun", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "java-1.7.0-openjdk", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "java-1.7.0-oracle", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "java-1.6.0-openjdk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "java-1.6.0-sun", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "java-1.7.0-openjdk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "java-1.7.0-oracle", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2013-01-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2013-1490\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-1490"], "statement": "This flaw was found to be a duplicate of CVE-2013-1518. Please see https://access.redhat.com/security/cve/CVE-2013-1518 for information about affected products and security errata."}