WaratekVRT Sign in

CVE-2013-2416 Oracle JRE

Affected softwareOracle JRE
Affected versions7 Update 17 and before
Severity4.3 Medium CVSS 2.0
Fixed inJava SE CPU Apr 2013
Published17 Apr 2013
Updated16 Jun 2026

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · earliest 2024-05-06.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2013-04-18.
  • EPSS 8.8% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2013-2416 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation fortinet.com /content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf 2024-05-06
IndexArtifactStarsFirst seen
Exploit-DB Java Web Start Launcher ActiveX Control - Memory Corruption 2013-04-18

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Inferred
  • Record active
Decided by The defect being in a component of a tracked product the agent does not reach: JavaFX, the Java SE installer, the JInitiator browser plug-in, the native WebLogic proxy plug-in, or a native part of Oracle Application Server or Collaboration Suite (HTTP Server, Web Cache, Internet Directory, mail and calendar servers). Oracle gives these no CPE of their own and names them only in the description.
Finding This CVE affects Oracle's Java SE Deployment component (JDK installer or client deployment tooling).

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Java SE CPU Apr 2013 ↗ CPU 2013-Q2 Oracle Java SE / Java Runtime Environment (7 Update 17 and before)
Oracle's note: Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Java SE Java Runtime Environment 7 Update 17 and before

Products and versions

2 products, 28 version entries
SourceVendorProductSchemeAffected versions
nvd oracle jdk javase 1.7.0 · ≤ 7.0.0.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 · 1.7.0:update7 · 1.7.0:update9 · 1.7.0:update10 · 1.7.0:update11 · 1.7.0:update13 · 1.7.0:update15
nvd oracle jre javase 1.7.0 · ≤ 7.0.0.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 · 1.7.0:update7 · 1.7.0:update9 · 1.7.0:update10 · 1.7.0:update11 · 1.7.0:update13 · 1.7.0:update15

References

URLTags
http://rhn.redhat.com/errata/RHSA-2013-0757.html
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html Vendor Advisory
http://www.us-cert.gov/ncas/alerts/TA13-107A US Government Resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16464

Timeline
Published2013-04-17By the CVE Program.
VulnCheck KEV: earliest evidence2024-05-06Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-16NVD's own last-modified date for this record.