CVE-2013-5907 — HIGH (10.0)

Vulnerability Description

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is due to incorrect input validation in LookupProcessor.cpp in the ICU Layout Engine, which allows attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted font file.

CVSS Score

10.0

HIGH

AV:N/AC:L/Au:N/C:C/I:C/A:C

Confidentiality

COMPLETE

Integrity

COMPLETE

Availability

COMPLETE

Affected Products

Vendor	Product	Versions
Oracle	Jdk	1.5.0
Oracle	Jre	1.5.0
Oracle	Jrockit	r27.7.7

References

FAQ

What is CVE-2013-5907?

CVE-2013-5907 is a vulnerability with a CVSS score of 10.0 (HIGH). Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and ...

How severe is CVE-2013-5907?

CVE-2013-5907 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-5907?

Check the references section above for vendor advisories and patch information. Affected products include: Oracle Jdk, Oracle Jre, Oracle Jrockit.