Oracle Critical Patch Update April 2013
Released April 2013 · Oracle's advisory ↗ · ← Java SE Critical Patch Update, February 2013 · Java SE Critical Patch Update, April 2013 →
128 CVEs in this release, one square each
By status
No exploit published. For 67 of them, Oracle's security advisory is the source of public detail.
Overview 37 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
37matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
1public PoC2.7%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
37
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
37
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
2.7%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
36
97.3%
split by
peak 26 / quarter
Q2 071
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 070
Q4 070
Q1 080
Q2 080
Q3 080
Q4 080
Q1 090
Q2 093
Not applicable3
Medium3
not blocked3
No public exploit3
Q3 090
Q4 090
Q1 101
Not applicable1
Medium1
not blocked1
No public exploit1
Q2 101
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 101
Not applicable1
Medium1
not blocked1
No public exploit1
Q4 100
Q1 110
Q2 110
Q3 110
Q4 110
Q1 120
Q2 120
Q3 121
Not applicable1
Medium1
not blocked1
No public exploit1
Q4 122
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
Q1 131
Not applicable1
Medium1
not blocked1
No public exploit1
Q2 1326
Not applicable26
Medium26
not blocked26
No public exploit26
Q2 07Q4 07Q2 08Q4 08Q2 09Q4 09Q2 10Q4 10Q2 11Q4 11Q2 12Q4 12Q2 13
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2013-2395 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language, a different vulnerability than CVE-2013-1567. |
| CVE-2013-2392 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer. |
| CVE-2013-2389 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. |
| CVE-2013-2378 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, 5.5.29 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema. |
| CVE-2013-2376 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.5.30 and earlier and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Stored Procedure. |
| CVE-2013-2375 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. |
| CVE-2013-1570 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.6.10 and earlier allows remote attackers to affect availability via unknown vectors related to MemCached. |
| CVE-2013-1555 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, and 5.5.29 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Partition. |
| CVE-2013-1552 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. |
| CVE-2013-1544 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language. |
| CVE-2013-1532 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Information Schema. |
| CVE-2013-1531 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Privileges. |
| CVE-2013-1526 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.5.29 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Replication. |
| CVE-2013-1523 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.5.29 and earlier and 5.6.10 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Optimizer. |
| CVE-2013-1521 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Locking. |
| CVE-2013-1515 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Middleware Products 3.0.1 and 3.1.2 allows remote attackers to affect integrity via vectors related to ADMIN Interface. |
| CVE-2013-1512 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.5.29 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language. |
| CVE-2013-1507 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Filesystem. |
| CVE-2013-1498 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Kernel/IO, a different vulnerability than CVE-2013-1496. |
| CVE-2013-1496 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Kernel/IO, a different vulnerability than CVE-2013-1498. |
| CVE-2013-1494 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10, when running on SPARC T4 servers, allows local users to affect availability via unknown vectors related to Kernel. |
| CVE-2013-0413 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Remote Execution Service. |
| CVE-2013-0411 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 8, 9, and 10 allows local users to affect confidentiality, integrity, and availability via vectors related to RBAC Configuration. |
| CVE-2013-0408 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability via vectors related to CPU performance counters drivers. |
| CVE-2013-0406 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect integrity via unknown vectors via vectors related to Kernel/IPsec. |
| CVE-2013-0405 | Medium | 2013-04-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows remote attackers to affect confidentiality and integrity via vectors related to NFS client mounts and IPv6. |
| CVE-2013-1495 | Medium | 2013-03-18 | Not applicable | No public exploit | asr in Oracle Auto Service Request in Oracle Support Tools before 4.3.2 allows local users to modify arbitrary files via a symlink attack on a predictable filename in /tmp. |
| CVE-2012-0841 | Medium | 2012-12-21 | Not applicable | No public exploit | libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data. |
| CVE-2012-5614 | Medium | 2012-12-03 | Not applicable | Working exploit published | Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements. |
| CVE-2012-2751 | Medium | 2012-07-22 | Not applicable | No public exploit | ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031. |
| CVE-2010-2791 | Medium | 2010-08-05 | Not applicable | No public exploit | mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions. |
| CVE-2010-2068 | Medium | 2010-06-18 | Not applicable | No public exploit | mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. |
| CVE-2010-0408 | Medium | 2010-03-05 | Not applicable | No public exploit | The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code. |
| CVE-2009-1956 | Medium | 2009-06-08 | Not applicable | No public exploit | Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input. |
| CVE-2009-0023 | Medium | 2009-06-08 | Not applicable | No public exploit | The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow. |
| CVE-2009-1191 | Medium | 2009-04-23 | Not applicable | No public exploit | mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request. |
| CVE-2007-1862 | Medium | 2007-06-04 | Not applicable | No public exploit | The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information. |