Red Hat Bugzilla – Bug 985501
CVE-2013-3006 CVE-2013-3007 CVE-2013-3008 CVE-2013-3009 CVE-2013-3010 CVE-2013-3011 CVE-2013-3012 IBM JDK: Unspecified security fixes (July 2013)
Last modified: 2016-04-21 08:38:22 EDT
The July 2013 updates for the IBM JDK (5.0 SR16-FP3, 6 SR14, 6.0.1 SR6, 7 SR5) contain patches for unspecified security flaws. For the majority of the flaws, upstream has provided a CVSSv2 base score of 9.3, which suggests a CVSSv2 vector of AV:N/AC:M/Au:N/C:P/I:P/A:P. The exception is CVE-2013-4002 with a CVSSv2 base score of 7.1. CVE CVSSv2 Score Fixed in CVE-2013-3006 9.3 7 SR5 CVE-2013-3007 9.3 6.0.1 SR6, 7 SR5 CVE-2013-3008 9.3 7 SR5 CVE-2013-3009 9.3 5.0 SR16-FP3, 6 SR14, 6.0.1 SR6, 7 SR5 CVE-2013-3010 9.3 6.0.1 SR6, 7 SR5 CVE-2013-3011 9.3 5.0 SR16-FP3, 6 SR14, 6.0.1 SR6, 7 SR5 CVE-2013-3012 9.3 5.0 SR16-FP3, 6 SR14, 6.0.1 SR6, 7 SR5 CVE-2013-4002 7.1 5.0 SR16-FP3, 6 SR14, 6.0.1 SR6, 7 SR5 References: https://www.ibm.com/developerworks/java/jdk/alerts/ http://www.ibm.com/developerworks/java/jdk/aix/j764/Java7_64.fixes.html#SR5 http://www.ibm.com/developerworks/java/jdk/aix/j664/Java6_64.fixes.html#SR14 http://www.ibm.com/developerworks/java/jdk/aix/j564/fixes.html#SR16FP3
These issues have been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2013:1081 https://rhn.redhat.com/errata/RHSA-2013-1081.html Via RHSA-2013:1059 https://rhn.redhat.com/errata/RHSA-2013-1059.html Via RHSA-2013:1060 https://rhn.redhat.com/errata/RHSA-2013-1060.html
Adam Gowdiak's (Security Explorations) post with details and PoC of some IBM JDK issues fixed in IBM July 2013 update. Mapping of Issue XX to these CVE ids remain unclear: http://seclists.org/fulldisclosure/2013/Jul/172 http://www.security-explorations.com/materials/SE-2012-01-IBM-2.pdf http://www.security-explorations.com/materials/se-2012-01-62-68.zip
(In reply to Tomas Hoger from comment #2) > Adam Gowdiak's (Security Explorations) post with details and PoC of some IBM > JDK issues fixed in IBM July 2013 update. Mapping of Issue XX to these CVE > ids remain unclear: The following post from Adam Gowdiak indicates that CVE-2013-3009 corresponds to Issue 67: http://seclists.org/fulldisclosure/2016/Apr/20