Oracle Critical Patch Update July 2013
Released July 2013 · Oracle's advisory ↗ · ← Java SE Critical Patch Update, June 2013 · Critical Patch Update, October 2013 →
89 CVEs in this release, one square each
By status
1Protected by Waratek3Mitigation candidate31No exploit published8Outside Waratek scope46Not applicable
2Exploited, marked by the ring
No exploit published. For 31 of them, Oracle's security advisory is the source of public detail.
Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.
Overview 12 matches · 1 in Waratek scope · 1 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
12matches
1in Waratek scope8.3%
1protected8.3%
1exploited8.3%
0CISA KEV0.0%
1public PoC8.3%
1EPSS ≥ 0.58.3%
Protected by Waratek
1
8.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
5
41.7%
Not applicable
6
50.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
8.3%
partly blocked
0
0.0%
not blocked
11
91.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
8.3%
Working exploit published
1
8.3%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
10
83.3%
split by
peak 10 / quarter
Q1 101
Outside Waratek scope1
High1
not blocked1
Working exploit published1
Q2 100
Q3 100
Q4 100
Q1 110
Q2 110
Q3 110
Q4 110
Q1 120
Q2 120
Q3 120
Q4 120
Q1 130
Q2 131
Protected by Waratek1
High1
blocked by ARMR today1
Exploited1
Q3 1310
Outside Waratek scope4
Not applicable6
High10
not blocked10
No public exploit10
Q1 10Q3 10Q1 11Q3 11Q1 12Q3 12Q1 13Q3 13
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2013-3779 | High | 2013-07-17 | Not applicable | No public exploit | Unspecified vulnerability in the Secure Global Desktop component in Oracle Virtualization All 4.6 releases including 4.63 and 4.7 prior to 4.71 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web UI. |
| CVE-2013-3774 | High | 2013-07-17 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Network Layer component in Oracle Database Server 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3, and 12.1.0.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. |
| CVE-2013-3771 | High | 2013-07-17 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Oracle executable component in Oracle Database Server 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-3760. |
| CVE-2013-3760 | High | 2013-07-17 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Oracle executable component in Oracle Database Server 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-3771. |
| CVE-2013-3754 | High | 2013-07-17 | Not applicable | No public exploit | Unspecified vulnerability in the Solaris Cluster component in Oracle and Sun Systems Products Suite 3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to HA for TimesTen. |
| CVE-2013-3753 | High | 2013-07-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Solaris 11 allows remote attackers to affect availability via vectors related to Kernel/STREAMS framework. |
| CVE-2013-3751 | High | 2013-07-17 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the XML Parser component in Oracle Database Server 11.2.0.2, 11.2.0.3, and 12.1.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. |
| CVE-2013-3750 | High | 2013-07-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Kernel/VM |
| CVE-2013-3748 | High | 2013-07-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Solaris 11 allows remote attackers to affect availability via vectors related to Driver/IDM (iSCSI Data Mover). |
| CVE-2013-3746 | High | 2013-07-17 | Not applicable | No public exploit | Unspecified vulnerability in the Solaris Cluster component in Oracle and Sun Systems Products Suite 3.2, 3.3, and 4 prior to 4.1 SRU 3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Zone Cluster Infrastructure. |
| CVE-2013-2461 | High | 2013-06-18 | Protected by Waratek | Exploited | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a "Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm." |
| CVE-2010-0425 | High | 2010-03-05 | Outside Waratek scope | Working exploit published | modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers." |