漏洞描述
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html↗blog.fuseyism.comhttp://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/↗security.gentoo.orghttp://security.gentoo.org/glsa/glsa-201406-32.xml↗wiki.mageia.orghttps://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html↗wiki.mageia.orghttps://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0757.html↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:161↗h30499.www3.hp.comhttp://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157↗www.zdnet.comhttp://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/↗www.us-cert.govhttp://www.us-cert.gov/ncas/alerts/TA13-107A↗hg.openjdk.java.nethttp://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/a19614a3dabb↗twitter.comhttps://twitter.com/thezdi/status/309425888188043264↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html↗mail.openjdk.java.nethttp://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html↗bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=920247↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:145↗blog.fuseyism.comhttp://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0752.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html↗www.ubuntu.comhttp://www.ubuntu.com/usn/USN-1806-1↗oval.cisecurity.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16511↗