Skip to content
Fencer Intel
critical 10.0

CVE-2013-1489 json

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Wind…

published 13y ago modified 4mo ago also EUVD-2013-1525

cvss
10.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
7.6%
EPSS 7.6% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka "Issue 53" and the "Java Security Slider" vulnerability.

Patch / fix

  • java-1.7.0-oracle RHEL 5 EXTRAS 1:1.7.0.13-1jpp.1.el5_9
  • java-1.7.0-oracle RHEL 6 EXTRAS 1:1.7.0.13-1jpp.3.el6_3
  • java-1.7.0-oracle-src RHEL 5 EXTRAS 1:1.7.0.13-1jpp.1.el5_9
  • java-1.7.0-oracle-src RHEL 6 EXTRAS 1:1.7.0.13-1jpp.3.el6_3
  • java-1.7.0-oracle-jdbc RHEL 5 EXTRAS 1:1.7.0.13-1jpp.1.el5_9
  • java-1.7.0-oracle-jdbc RHEL 6 EXTRAS 1:1.7.0.13-1jpp.3.el6_3
  • java-1.7.0-oracle-javafx RHEL 5 EXTRAS 1:1.7.0.13-1jpp.1.el5_9
  • java-1.7.0-oracle-javafx RHEL 6 EXTRAS 1:1.7.0.13-1jpp.3.el6_3

red hat advisories RHSA-2013:0237

Is CVE-2013-1489 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-1489 updated cvss 0.0

7: bypass of the security level setting in browser plugin (Deployment, SE-2012-01 Issue 53)

  • Red Hat Enterprise Linux 5 java-1.4.2-ibm
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.0-oracle 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-src 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-jdbc 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-javafx 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-plugin 1.7.0.13-1jpp.3.el6_3 Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.0-oracle 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-src 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-javafx 1.7.0.13-1jpp.3.el6_3 Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.7.0-oracle 1.7.0.13-1jpp.1.el5_9, java-1.7.0-oracle-src 1.7.0.13-1jpp.1.el5_9, java-1.7.0-oracle-jdbc 1.7.0.13-1jpp.1.el5_9, java-1.7.0-oracle-javafx 1.7.0.13-1jpp.1.el5_9, java-1.7.0-oracle-plugin 1.7.0.13-1jpp.1.el5_9 Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.0-oracle 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-src 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-jdbc 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-javafx 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-plugin 1.7.0.13-1jpp.3.el6_3 Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.0-oracle 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-src 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-jdbc 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-javafx 1.7.0.13-1jpp.3.el6_3, java-1.7.0-oracle-plugin 1.7.0.13-1jpp.3.el6_3
    fixed: vendor fix RHSA-2013:0237
  • Red Hat Enterprise Linux 5 java-1.5.0-ibm, java-1.6.0-ibm, java-1.7.0-ibm, java-1.7.0-openjdk Red Hat Enterprise Linux 6 java-1.5.0-ibm, java-1.6.0-ibm, java-1.7.0-ibm, java-1.5.0-ibm-src, java-1.6.0-ibm-src, java-1.7.0-ibm-src, +15 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

7.64% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.