Microsoft Security
Mentions the CVE; no further detail.
2 passages name itOriginal (opens in a new tab) ↗
CVE-2013-1493 Public exploit EPSS 86.2%
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41…
Summary
The color management (CMM) functionality in the 2D component of Oracle Java SE (7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier) contains a flaw that can be triggered by crafted raster parameters, leading to an out-of-bounds read or memory corruption in the JVM. A remote attacker can exploit it by supplying a specially crafted image, potentially executing arbitrary code or causing a denial of service (crash), with no authentication indicated and user interaction implied by the need for the victim to process the image.
Official description · CVE.org
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
75.2 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 1
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited the day it was disclosed. Public exploit code (Metasploit) was available 3 days before disclosure.
- Public exploit codeMetasploit3 days before
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo high- or medium-confidence techniques. The 2 available links are lower confidence and listed below.
Lower-confidence links (2)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Drive-by CompromiseT1189 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
- Exploitation for Client ExecutionT1203 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
What security researchers reported
Named in 1 threat report1 reportMicrosoft
Reports are matched by finding the exact id CVE-2013-1493 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 3 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.