CVE-2013-2465
Oracle Java SE Unspecified Vulnerability
Description
CVE-2013-2465 is a critical memory corruption vulnerability in Oracle Java SE 7 Update 21 and earlier, Java SE 6 Update 45 and earlier, and Java SE Embedded 7 Update 21 and earlier. The flaw exists in the 2D component and allows an unauthenticated attacker to execute arbitrary code via a specially crafted Java applet or application. With an EPSS score of 97.4% (99.9th percentile), this vulnerability is one of the most exploited Java runtime flaws in history. CISA added CVE-2013-2465 to the Known Exploited Vulnerabilities catalog, confirming widespread active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | jre | 1.7.0; 1.6.0; 1.5.0 |
| sun | jre | 1.6.0; 1.5.0 |
| suse | linux enterprise desktop | 10 |
| suse | linux enterprise java | 10; 11 |
| suse | linux enterprise server | 10; 11 |
| suse | linux enterprise software development kit | 11 |
References
- http://advisories.mageia.org/MGASA-2013-0185.html(Broken Link)
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880(Broken Link)
- http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040(Patch)
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html(Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=137545505800971&w=2(Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=137545592101387&w=2(Mailing List, Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-0963.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-1059.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-1060.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-1081.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-1455.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-1456.html(Third Party Advisory)
- http://secunia.com/advisories/54154(Not Applicable)
- http://security.gentoo.org/glsa/glsa-201406-32.xml(Third Party Advisory)
- http://www-01.ibm.com/support/docview.wss?uid=swg21642336(Third Party Advisory)
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:183(Not Applicable)
- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html(Vendor Advisory)
- http://www.securityfocus.com/bid/60657(Broken Link, Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/ncas/alerts/TA13-169A(Third Party Advisory, US Government Resource)
- https://access.redhat.com/errata/RHSA-2014:0414(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=975118(Issue Tracking)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17106(Broken Link)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19074(Broken Link)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19455(Broken Link)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19703(Broken Link)
- https://www.vicarius.io/vsociety/posts/cve-2013-2465-detect-java-vulnerability(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2013-2465-mitigate-java-vulnerability(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2465(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2013-2465 results from improper memory handling in Oracle Java's 2D rendering component. The vulnerability allows operations to occur outside the intended bounds of a memory buffer, enabling an attacker to corrupt adjacent memory structures and hijack program execution to run arbitrary code.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2013-2465 has a CVSS v2 base score of 10.0 (Critical), the maximum possible severity rating. The vulnerability requires no authentication and can be exploited remotely through a web browser when a user visits a page containing a malicious Java applet. Successful exploitation leads to complete compromise of the affected system, including arbitrary code execution with the privileges of the Java process. The EPSS score of 97.4% (99.9th percentile) indicates that this vulnerability is among the most actively exploited Java vulnerabilities globally. Multiple exploit kits have leveraged this flaw to deliver malware payloads at scale, making it a significant threat to any organization with unpatched Java installations.
Exploit Maturity
CVE-2013-2465 has been widely exploited since its disclosure, with public exploit code available through multiple channels. Several major exploit kits including Magnitude, RIG, and Nuclear incorporated this vulnerability to deliver ransomware and banking trojans. CISA has confirmed active exploitation by including it in the KEV catalog. The EPSS score of 97.4% (99.9th percentile) reflects the extensive real-world exploitation activity that has targeted this Java vulnerability.
Remediation
- Update Oracle Java SE to a version that addresses CVE-2013-2465. Apply the patches provided in Oracle's Critical Patch Update from June 2013 or upgrade to a newer supported Java version.
- Disable Java browser plugins in all web browsers across the organization. The primary attack vector is through malicious Java applets served via compromised or attacker-controlled websites.
- Remove Java from systems where it is not required. Conduct an inventory of Java installations and decommission unnecessary instances to reduce the attack surface.
- Implement application whitelisting to prevent unauthorized Java applets and applications from executing, even if users visit compromised websites.
- Deploy network-level intrusion detection with signatures for known Java exploitation patterns to identify and block attack attempts targeting unpatched systems.
Technical Details
CVE-2013-2465 is a memory corruption vulnerability (CWE-119) in the 2D component of Oracle Java SE. The flaw lies in the native code responsible for image processing and rendering, where improper bounds checking allows an attacker to write data beyond the allocated buffer. By crafting a malicious Java applet that triggers specific 2D rendering operations, an attacker can corrupt heap metadata and gain control of the instruction pointer. The vulnerability is particularly dangerous because Java applets could be loaded automatically by web browsers with Java plugins enabled, requiring no user interaction beyond visiting a compromised web page. The CVSS v2 vector reflects the maximum impact across confidentiality, integrity, and availability, with no authentication or special access required.
Frequently Asked Questions
Is CVE-2013-2465 being actively exploited?
Yes, CVE-2013-2465 has been extensively exploited since 2013 and remains a favored target for exploit kits. CISA confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 97.4% (99.9th percentile) reflects the widespread exploitation activity.
What products are affected by CVE-2013-2465?
Oracle Java SE 7 Update 21 and earlier, Java SE 6 Update 45 and earlier, and Java SE Embedded 7 Update 21 and earlier are affected. The vulnerability is in the 2D rendering component used across all these versions.
How do I fix CVE-2013-2465?
Apply the Oracle Critical Patch Update from June 2013 or upgrade to a current supported Java version. Disable Java browser plugins immediately and remove Java installations where they are not required. See the Remediation section for detailed guidance.
How severe is CVE-2013-2465?
CVE-2013-2465 has the maximum CVSS v2 score of 10.0 (Critical). It enables unauthenticated remote code execution through malicious Java applets, requires no user interaction beyond visiting a web page, and has been extensively weaponized in exploit kits delivering malware and ransomware.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.