CVE-2013-0443 — MEDIUM (4.0)

Vulnerability Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key.

CVSS Score

4.0

MEDIUM

AV:N/AC:H/Au:N/C:P/I:P/A:N

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

NONE

Affected Products

Vendor	Product	Versions
Oracle	Jre	1.7.0
Oracle	Jdk	1.7.0
Sun	Jre	1.6.0
Sun	Jdk	1.6.0

References

FAQ

What is CVE-2013-0443?

CVE-2013-0443 is a vulnerability with a CVSS score of 4.0 (MEDIUM). Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and...

How severe is CVE-2013-0443?

CVE-2013-0443 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-0443?

Check the references section above for vendor advisories and patch information. Affected products include: Oracle Jre, Oracle Jdk, Sun Jre, Sun Jdk.