The July 2013 updates for the IBM JDK (5.0 SR16-FP3, 6 SR14, 6.0.1 SR6, 7 SR5) contain patches for unspecified security flaws. For the majority of the flaws, upstream has provided a CVSSv2 base score of 9.3, which suggests a CVSSv2 vector of AV:N/AC:M/Au:N/C:P/I:P/A:P. The exception is CVE-2013-4002 with a CVSSv2 base score of 7.1. CVE CVSSv2 Score Fixed in CVE-2013-3006 9.3 7 SR5 CVE-2013-3007 9.3 6.0.1 SR6, 7 SR5 CVE-2013-3008 9.3 7 SR5 CVE-2013-3009 9.3 5.0 SR16-FP3, 6 SR14, 6.0.1 SR6, 7 SR5 CVE-2013-3010 9.3 6.0.1 SR6, 7 SR5 CVE-2013-3011 9.3 5.0 SR16-FP3, 6 SR14, 6.0.1 SR6, 7 SR5 CVE-2013-3012 9.3 5.0 SR16-FP3, 6 SR14, 6.0.1 SR6, 7 SR5 CVE-2013-4002 7.1 5.0 SR16-FP3, 6 SR14, 6.0.1 SR6, 7 SR5 References: https://www.ibm.com/developerworks/java/jdk/alerts/ http://www.ibm.com/developerworks/java/jdk/aix/j764/Java7_64.fixes.html#SR5 http://www.ibm.com/developerworks/java/jdk/aix/j664/Java6_64.fixes.html#SR14 http://www.ibm.com/developerworks/java/jdk/aix/j564/fixes.html#SR16FP3
These issues have been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2013:1081 https://rhn.redhat.com/errata/RHSA-2013-1081.html Via RHSA-2013:1059 https://rhn.redhat.com/errata/RHSA-2013-1059.html Via RHSA-2013:1060 https://rhn.redhat.com/errata/RHSA-2013-1060.html
Adam Gowdiak's (Security Explorations) post with details and PoC of some IBM JDK issues fixed in IBM July 2013 update. Mapping of Issue XX to these CVE ids remain unclear: http://seclists.org/fulldisclosure/2013/Jul/172 http://www.security-explorations.com/materials/SE-2012-01-IBM-2.pdf http://www.security-explorations.com/materials/se-2012-01-62-68.zip
(In reply to Tomas Hoger from comment #2) > Adam Gowdiak's (Security Explorations) post with details and PoC of some IBM > JDK issues fixed in IBM July 2013 update. Mapping of Issue XX to these CVE > ids remain unclear: The following post from Adam Gowdiak indicates that CVE-2013-3009 corresponds to Issue 67: http://seclists.org/fulldisclosure/2016/Apr/20