WaratekVRT Sign in

Oracle Critical Patch Update April 2013

Released April 2013 · Oracle's advisory ↗ · ← Java SE Critical Patch Update, February 2013 · Java SE Critical Patch Update, April 2013 →

128 CVEs in this release, one square each

Mitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update April 2013, one square per CVE: 69 Java CVEs, 59 other CVEs in this release.

Download the image

By status

2Mitigation candidate67No exploit published4Outside Waratek scope55Not applicable

No exploit published. For 67 of them, Oracle's security advisory is the source of public detail.

Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 128 matches · 69 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
128matches 69in Waratek scope53.9% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 4public PoC3.1% 2EPSS ≥ 0.51.6%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 1.6% No exploit published 67 52.3% Outside Waratek scope 4 3.1% Not applicable 55 43.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 5 3.9% Medium 90 70.3% Low 33 25.8% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 128 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 4 3.1% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 124 96.9%
split by peak 114 / quarter
Not applicable: 55Outside Waratek scope: 4No exploit published: 67Mitigation candidate: 2 Low: 33Medium: 90High: 5 not blocked: 128 No public exploit: 124Working exploit published: 4
Q2 071 Not applicable1 Medium1 not blocked1 No public exploit1 Q3 070 Q4 070 Q1 080 Q2 080 Q3 080 Q4 080 Q1 090 Q2 094 Not applicable4 High1 Medium3 not blocked4 Working exploit published1 No public exploit3 Q3 091 Not applicable1 High1 not blocked1 No public exploit1 Q4 091 Not applicable1 High1 not blocked1 No public exploit1 Q1 101 Not applicable1 Medium1 not blocked1 No public exploit1 Q2 101 Not applicable1 Medium1 not blocked1 No public exploit1 Q3 101 Not applicable1 Medium1 not blocked1 No public exploit1 Q4 100 Q1 110 Q2 110 Q3 110 Q4 110 Q1 120 Q2 120 Q3 121 Not applicable1 Medium1 not blocked1 No public exploit1 Q4 122 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 Q1 131 Not applicable1 Medium1 not blocked1 No public exploit1 Q2 13114 Mitigation candidate2 No exploit published67 Outside Waratek scope4 Not applicable41 High2 Medium79 Low33 not blocked114 Working exploit published2 No public exploit112
Q2 07Q4 07Q2 08Q4 08Q2 09Q4 09Q2 10Q4 10Q2 11Q4 11Q2 12Q4 12Q2 13
128 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2013-1494 Medium 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10, when running on SPARC T4 servers, allows local users to affect availability via unknown vectors related to Kernel.
CVE-2013-0416 Medium 2013-04-17 No exploit published No public exploit Unspecified vulnerability in the Siebel Enterprise Application Integration component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Services, a different vulnerability than CVE-2013-2403.
CVE-2013-0413 Medium 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Remote Execution Service.
CVE-2013-0412 Low 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect integrity and availability via unknown vectors related to Utility/pax.
CVE-2013-0411 Medium 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 8, 9, and 10 allows local users to affect confidentiality, integrity, and availability via vectors related to RBAC Configuration.
CVE-2013-0410 Medium 2013-04-17 No exploit published No public exploit Unspecified vulnerability in the Agile EDM component in Oracle Supply Chain Products Suite 6.1.1.0, 6.1.2.0, and 6.1.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Base Component - Common Objects.
CVE-2013-0408 Medium 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability via vectors related to CPU performance counters drivers.
CVE-2013-0406 Medium 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect integrity via unknown vectors via vectors related to Kernel/IPsec.
CVE-2013-0405 Medium 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows remote attackers to affect confidentiality and integrity via vectors related to NFS client mounts and IPv6.
CVE-2013-0404 Low 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Kernel/Boot.
CVE-2013-0403 Low 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect availability via unknown vectors related to Utility.
CVE-2012-4303 Low 2013-04-17 No exploit published No public exploit Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 11.1.1.6.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Content Server.
CVE-2012-0570 Low 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect availability via unknown vectors related to Libraries/Libc.
CVE-2012-0568 Low 2013-04-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 8, 9, and 10 allows local users to affect confidentiality via unknown vectors related to Utility/fdformat.
CVE-2013-1495 Medium 2013-03-18 Not applicable No public exploit asr in Oracle Auto Service Request in Oracle Support Tools before 4.3.2 allows local users to modify arbitrary files via a symlink attack on a predictable filename in /tmp.
CVE-2012-0841 Medium 2012-12-21 Not applicable No public exploit libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.
CVE-2012-5614 Medium 2012-12-03 Not applicable Working exploit published Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.
CVE-2012-2751 Medium 2012-07-22 Not applicable No public exploit ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.
CVE-2010-2791 Medium 2010-08-05 Not applicable No public exploit mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
CVE-2010-2068 Medium 2010-06-18 Not applicable No public exploit mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.
CVE-2010-0408 Medium 2010-03-05 Not applicable No public exploit The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.
CVE-2009-2699 High 2009-10-13 Not applicable No public exploit The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
CVE-2009-1890 High 2009-07-05 Not applicable No public exploit The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
CVE-2009-1956 Medium 2009-06-08 Not applicable No public exploit Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.
CVE-2009-1955 High 2009-06-08 Not applicable Working exploit published The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
CVE-2009-0023 Medium 2009-06-08 Not applicable No public exploit The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
CVE-2009-1191 Medium 2009-04-23 Not applicable No public exploit mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
CVE-2007-1862 Medium 2007-06-04 Not applicable No public exploit The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.
‹ prev page 2 of 2 next ›