VRT Sign in

Java SE CPU Feb 2013

Released February 2013 · Oracle's advisory ↗ · ← Critical Patch Update, January 2013 · Critical Patch Update, April 2013 →

55 CVEs in this release, one square each

By status

3No exploit published 52Outside Waratek scope 2Exploited, marked by the ring

No exploit published. For 2 of them, Oracle's security advisory is the source of public detail.

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5

2matches 0in Waratek scope0.0% 0protected0.0% 1exploited50.0% 1CISA KEV50.0% 1public PoC50.0% 1EPSS ≥ 0.550.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 2 100.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%

Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 2 100.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 50.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 1 50.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Jan 131 Outside Waratek scope1 Low1 not blocked1 Exploited1 Feb 131 Outside Waratek scope1 Low1 not blocked1 No public exploit1

Jan 13Feb 13

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2013-0169	Low	2013-02-08	Outside Waratek scope	No public exploit	The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
CVE-2013-0431	Low	2013-01-31	Outside Waratek scope	Exploited	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2013-0169

Low

2013-02-08

Outside Waratek scope

No public exploit

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

CVE-2013-0431

Low

2013-01-31

Outside Waratek scope

Exploited

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.