WaratekVRT Sign in

CVE-2013-1493

Affected software2 products, listed below
Severity10.0 High CVSS 2.0
WeaknessBuffer errors (CWE-119)
Published5 Mar 2013
Updated19 Oct 2026

Description

The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 7 citations · earliest 2013-03-04.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB, Metasploit; first seen 2013-03-29.
  • EPSS 86% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.7% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2013-1493 in VulnCheck (free account), which lists 2 more citations not shown here.

EvidenceSourceDetailDate
Reported exploitation cve.org /CVERecord?id=CVE-2013-1493 2013-03-04
Reported exploitation fireeye.com /blog/threat-research/2013/05/ready-for-summer-the-sunshop-campaign.html 2013-05-20
Reported exploitation krebsonsecurity.com /2013/07/styx-exploit-pack-domo-arigato-pc-roboto 2013-07-08
Reported exploitation paper.seebug.org /papers/APT/APT_CyberCriminal_Campagin/2013/hidden_lynx.pdf 2013-09-17
Reported exploitation cisa.gov /news-events/alerts/2013/03/05/oracle-java-contains-multiple-vulnerabilities 2016-10-19
IndexArtifactStarsFirst seen
Exploit-DB Java CMM - Remote Code Execution (Metasploit) 2013-03-29
Metasploit Java CMM Remote Code Execution (normal rank)

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to Outside Waratek scope.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Client-side: fixed out of band by Oracle's Security Alert for CVE-2013-1493 (March 2013), which says it affects Java running in web browsers and is "not applicable to Java running on servers, standalone Java desktop applications or embedded Java applications. They also do not affect Oracle server-based software." The exploit used in the wild, and Metasploit's windows/browser/java_cmm (EDB-24904), is an applet that corrupts memory in the 2D color management code to escape the sandbox. It never appeared in a CPU risk matrix, so java-client-side has no note to read.

Affected software and releases

Products and versions

4 products, 174 version entries
SourceVendorProductSchemeAffected versions
nvd oracle jdk javase ≤ 5.0.0.0 · 1.5.0:update36 · 1.5.0:update38 · ≤ 6.0.0.0 · 1.6.0:update22 · 1.6.0:update23 · 1.6.0:update24 · 1.6.0:update25 · 1.6.0:update26 · 1.6.0:update27 · 1.6.0:update29 · 1.6.0:update30 · 1.6.0:update31 · 1.6.0:update32 · 1.6.0:update33 · 1.6.0:update34 · 1.6.0:update35 · 1.6.0:update37 · 1.6.0:update38 · 1.6.0:update39 · 1.7.0 · ≤ 7.0.0.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 · 1.7.0:update7 · 1.7.0:update9 · 1.7.0:update10 · 1.7.0:update11 · 1.7.0:update13
nvd oracle jre javase ≤ 5.0.0.0 · 1.5.0:update36 · 1.5.0:update38 · ≤ 6.0.0.0 · 1.6.0:update22 · 1.6.0:update23 · 1.6.0:update24 · 1.6.0:update25 · 1.6.0:update26 · 1.6.0:update27 · 1.6.0:update29 · 1.6.0:update30 · 1.6.0:update31 · 1.6.0:update32 · 1.6.0:update33 · 1.6.0:update34 · 1.6.0:update35 · 1.6.0:update37 · 1.6.0:update38 · 1.6.0:update39 · 1.7.0 · ≤ 7.0.0.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 · 1.7.0:update7 · 1.7.0:update9 · 1.7.0:update10 · 1.7.0:update11 · 1.7.0:update13
nvd sun jdk javase 1.5.0 · 1.5.0:update1 · 1.5.0:update2 · 1.5.0:update3 · 1.5.0:update4 · 1.5.0:update5 · 1.5.0:update6 · 1.5.0:update7 · 1.5.0:update7_b03 · 1.5.0:update8 · 1.5.0:update9 · 1.5.0:update10 · 1.5.0:update11 · 1.5.0:update11_b03 · 1.5.0:update12 · 1.5.0:update13 · 1.5.0:update14 · 1.5.0:update15 · 1.5.0:update16 · 1.5.0:update17 · 1.5.0:update18 · 1.5.0:update19 · 1.5.0:update20 · 1.5.0:update21 · 1.5.0:update22 · 1.5.0:update23 · 1.5.0:update24 · 1.5.0:update25 · 1.5.0:update26 · 1.5.0:update27 · 1.5.0:update28 · 1.5.0:update29 · 1.5.0:update31 · 1.5.0:update33 · 1.6.0 · 1.6.0:update1 · 1.6.0:update1_b06 · 1.6.0:update2 · 1.6.0:update_3 · 1.6.0:update_4 · 1.6.0:update_5 · 1.6.0:update_6 · 1.6.0:update_7 · 1.6.0:update_10 · 1.6.0:update_11 · 1.6.0:update_12 · 1.6.0:update_13 · 1.6.0:update_14 · 1.6.0:update_15 · 1.6.0:update_16 · 1.6.0:update_17 · 1.6.0:update_18 · 1.6.0:update_19 · 1.6.0:update_20 · 1.6.0:update_21
nvd sun jre javase 1.5.0 · 1.5.0:update1 · 1.5.0:update2 · 1.5.0:update3 · 1.5.0:update4 · 1.5.0:update5 · 1.5.0:update6 · 1.5.0:update7 · 1.5.0:update8 · 1.5.0:update9 · 1.5.0:update10 · 1.5.0:update11 · 1.5.0:update12 · 1.5.0:update13 · 1.5.0:update14 · 1.5.0:update15 · 1.5.0:update16 · 1.5.0:update17 · 1.5.0:update18 · 1.5.0:update19 · 1.5.0:update20 · 1.5.0:update21 · 1.5.0:update22 · 1.5.0:update23 · 1.5.0:update24 · 1.5.0:update25 · 1.5.0:update26 · 1.5.0:update27 · 1.5.0:update28 · 1.5.0:update29 · 1.5.0:update31 · 1.5.0:update33 · 1.6.0 · 1.6.0:update_1 · 1.6.0:update_2 · 1.6.0:update_3 · 1.6.0:update_4 · 1.6.0:update_5 · 1.6.0:update_6 · 1.6.0:update_7 · 1.6.0:update_9 · 1.6.0:update_10 · 1.6.0:update_11 · 1.6.0:update_12 · 1.6.0:update_13 · 1.6.0:update_14 · 1.6.0:update_15 · 1.6.0:update_16 · 1.6.0:update_17 · 1.6.0:update_18 · 1.6.0:update_19 · 1.6.0:update_20 · 1.6.0:update_21

References

URLTags
https://access.redhat.com/errata/RHSA-2013:0602 ADVISORY, RHSA-2013:0602
https://access.redhat.com/security/cve/CVE-2013-1493 REPORT, RHSA-2013:0602
https://access.redhat.com/errata/RHSA-2013:0603 ADVISORY, RHSA-2013:0603
https://access.redhat.com/errata/RHSA-2013:0604 ADVISORY, RHSA-2013:0604
https://access.redhat.com/errata/RHSA-2013:0605 ADVISORY, RHSA-2013:0605
http://blog.fireeye.com/research/2013/02/yaj0-yet-another-java-zero-day-2.html
http://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04117626-1
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00012.html

Timeline
VulnCheck KEV: earliest evidence2013-03-04Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Published2013-03-05By the CVE Program.
VulnCheck KEV: latest evidence2021-10-05Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-16NVD's own last-modified date for this record.
Last VRT activity2026-10-19Most recent commit touching this CVE's classification, patch or rule file.
Classification created2026-11-13First commit adding this CVE's research note.