Oracle Critical Patch Update July 2013
Released July 2013 · Oracle's advisory ↗ · ← Java SE Critical Patch Update, June 2013 · Critical Patch Update, October 2013 →
89 CVEs in this release, one square each
By status
1Protected by Waratek3Mitigation candidate31No exploit published8Outside Waratek scope46Not applicable
2Exploited, marked by the ring
No exploit published. For 31 of them, Oracle's security advisory is the source of public detail.
Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.
Overview 11 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 3 EPSS ≥ 0.5
11matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
2public PoC18.2%
3EPSS ≥ 0.527.3%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
2
18.2%
Not applicable
9
81.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
11
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
2
18.2%
Proof of concept only
0
0.0%
Forecast only
2
18.2%
No public exploit
7
63.6%
split by
peak 2 / quarter
Q4 051
Not applicable1
Medium1
not blocked1
Forecast only1
Q1 060
Q2 060
Q3 060
Q4 060
Q1 070
Q2 071
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 071
Not applicable1
Medium1
not blocked1
No public exploit1
Q4 071
Not applicable1
Medium1
not blocked1
No public exploit1
Q1 081
Not applicable1
Medium1
not blocked1
Forecast only1
Q2 081
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 080
Q4 080
Q1 090
Q2 090
Q3 090
Q4 090
Q1 102
Outside Waratek scope1
Not applicable1
High1
Medium1
not blocked2
Working exploit published1
No public exploit1
Q2 101
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 100
Q4 100
Q1 110
Q2 111
Not applicable1
Medium1
not blocked1
Working exploit published1
Q3 111
Outside Waratek scope1
Medium1
not blocked1
No public exploit1
Q1 06Q3 06Q1 07Q3 07Q1 08Q3 08Q1 09Q3 09Q1 10Q3 10Q1 11Q3 11
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2011-3348 | Medium | 2011-09-20 | Outside Waratek scope | No public exploit | The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request. |
| CVE-2011-0419 | Medium | 2011-05-16 | Not applicable | Working exploit published | Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. |
| CVE-2010-2068 | Medium | 2010-06-18 | Not applicable | No public exploit | mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. |
| CVE-2010-0434 | Medium | 2010-03-05 | Not applicable | No public exploit | The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request. |
| CVE-2010-0425 | High | 2010-03-05 | Outside Waratek scope | Working exploit published | modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers." |
| CVE-2008-2364 | Medium | 2008-06-13 | Not applicable | No public exploit | The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses. |
| CVE-2007-6388 | Medium | 2008-01-08 | Not applicable | Forecast only | Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2007-5000 | Medium | 2007-12-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2007-3847 | Medium | 2007-08-23 | Not applicable | No public exploit | The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read. |
| CVE-2006-5752 | Medium | 2007-06-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified. |
| CVE-2005-3352 | Medium | 2005-12-13 | Not applicable | Forecast only | Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps. |