VIR Vulnerability Intelligence Relay

CVE-2013-1476

critical
Published 2013-02-02 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
10.0

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-0441 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors."

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Application impact
VendorProductVersionsFixed
oracle oraclejre1.7.0
oracle oraclejdk1.7.0
oracle oraclejre1.6.0
sunjre1.6.0
oracle oraclejdk1.6.0
sunjdk1.6.0
oracle oraclejre1.5.0
sunjre1.5.0
oracle oraclejdk1.5.0
sunjdk1.5.0
oracle oraclejre{"endIncluding":"1.4.2_40"}
oracle oraclejre1.4.2_38
sunjre1.4.2
sunjre1.4.2_1
sunjre1.4.2_2
sunjre1.4.2_3
sunjre1.4.2_4
sunjre1.4.2_5
sunjre1.4.2_6
sunjre1.4.2_7
sunjre1.4.2_8
sunjre1.4.2_9
sunjre1.4.2_10
sunjre1.4.2_11
sunjre1.4.2_12
sunjre1.4.2_13
sunjre1.4.2_14
sunjre1.4.2_15
sunjre1.4.2_16
sunjre1.4.2_17
sunjre1.4.2_18
sunjre1.4.2_19
sunjre1.4.2_20
sunjre1.4.2_21
sunjre1.4.2_22
sunjre1.4.2_23
sunjre1.4.2_24
sunjre1.4.2_25
sunjre1.4.2_26
sunjre1.4.2_27
sunjre1.4.2_28
sunjre1.4.2_29
sunjre1.4.2_30
sunjre1.4.2_31
sunjre1.4.2_32
sunjre1.4.2_33
sunjre1.4.2_34
sunjre1.4.2_35
sunjre1.4.2_36
sunjre1.4.2_37
oracle oraclejdk{"endIncluding":"1.4.2_40"}
oracle oraclejdk1.4.2_38
sunjdk1.4.2
sunjdk1.4.2_1
sunjdk1.4.2_2
sunjdk1.4.2_3
sunjdk1.4.2_4
sunjdk1.4.2_5
sunjdk1.4.2_6
sunjdk1.4.2_7
sunjdk1.4.2_8
sunjdk1.4.2_9
sunjdk1.4.2_10
sunjdk1.4.2_11
sunjdk1.4.2_12
sunjdk1.4.2_13
sunjdk1.4.2_14
sunjdk1.4.2_15
sunjdk1.4.2_16
sunjdk1.4.2_17
sunjdk1.4.2_18
sunjdk1.4.2_19
sunjdk1.4.2_22
sunjdk1.4.2_23
sunjdk1.4.2_25
sunjdk1.4.2_26
sunjdk1.4.2_27
sunjdk1.4.2_28
sunjdk1.4.2_29
sunjdk1.4.2_30
sunjdk1.4.2_31
sunjdk1.4.2_32
sunjdk1.4.2_33
sunjdk1.4.2_34
sunjdk1.4.2_35
sunjdk1.4.2_36
sunjdk1.4.2_37

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.