CVE-2013-0401

38

FAUCET Score

CVE-2013-0401 describes a critical remote code execution vulnerability affecting Oracle Java SE (versions 7u17 and earlier, 6u43 and earlier, 5.0u41 and earlier) and OpenJDK (versions 6 and 7), specifically within the AWT component. With a CVSS score of 10.0, this flaw allows unauthenticated remote attackers to execute arbitrary code with full confidentiality, integrity, and availability impact. While demonstrated in a Pwn2Own competition, there is no public exploit code available, nor is there evidence of active exploitation or significant community discussion.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		1.7.0CPE matchmatch criteria	cpe:2.3:a:oracle:jdk:1.7.0:update17::::::
		1.7.0CPE matchmatch criteria	cpe:2.3:a:oracle:jre:1.7.0:update17::::::

CVSS Data

CVSS version used by this source: 2.0

10.0HIGH

AV:N/AC:L/Au:N/C:C/I:C/A:C

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Exploitability Score

10.0

Impact Score

10.0

CvssVersion

2.0

Exploit Intelligence

EPSS Score

10.34%

Probability of exploitation in next 30 days

EPSS Percentile

95.2%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.1034 is in the 93rd percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (16)

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.7.0-openjdk-1:1.7.0.19-2.3.9.1.el5_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: java-1.6.0-openjdk-1:1.6.0.0-1.40.1.11.11.el5_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: java-1.7.0-openjdk-1:1.7.0.19-2.3.9.1.el6_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: java-1.6.0-openjdk-1:1.6.0.0-1.61.1.11.11.el6_4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.4Fixed in: java-1.6.0-ibm-1:1.6.0.14.0-1jpp.1.el5_9

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.5Fixed in: java-1.6.0-ibm-1:1.6.0.14.0-1jpp.1.el5_9

redhatpatch availablevia redhat_api

Product: Supplementary for Red Hat Enterprise Linux 5Fixed in: java-1.7.0-oracle-1:1.7.0.21-1jpp.1.el5

redhatpatch availablevia redhat_api

Product: Supplementary for Red Hat Enterprise Linux 5Fixed in: java-1.6.0-sun-1:1.6.0.45-1jpp.1.el5_9

redhatpatch availablevia redhat_api

Product: Supplementary for Red Hat Enterprise Linux 5Fixed in: java-1.7.0-ibm-1:1.7.0.4.2-1jpp.1.el5_9

redhatpatch availablevia redhat_api

Product: Supplementary for Red Hat Enterprise Linux 5Fixed in: java-1.6.0-ibm-1:1.6.0.13.2-1jpp.1.el5_9

redhatpatch availablevia redhat_api

Product: Supplementary for Red Hat Enterprise Linux 5Fixed in: java-1.5.0-ibm-1:1.5.0.16.2-1jpp.1.el5_9

redhatpatch availablevia redhat_api

Product: Supplementary for Red Hat Enterprise Linux 6Fixed in: java-1.7.0-oracle-1:1.7.0.21-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Supplementary for Red Hat Enterprise Linux 6Fixed in: java-1.6.0-sun-1:1.6.0.45-1jpp.1.el6

redhatpatch availablevia redhat_api

Product: Supplementary for Red Hat Enterprise Linux 6Fixed in: java-1.7.0-ibm-1:1.7.0.4.2-1jpp.1.el6_4

redhatpatch availablevia redhat_api

Product: Supplementary for Red Hat Enterprise Linux 6Fixed in: java-1.6.0-ibm-1:1.6.0.13.2-1jpp.1.el6_4

redhatpatch availablevia redhat_api

Product: Supplementary for Red Hat Enterprise Linux 6Fixed in: java-1.5.0-ibm-1:1.5.0.16.2-1jpp.1.el6_4

Vendor Advisories (1)

redhatCVE-2013-0401Critical

OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305)

References

blog.fuseyism.com / index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released

blog.fuseyism.com / index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released

h20000.www2.hp.com / bizsupport/TechSupport/Document.jsp

h30499.www3.hp.com / t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157

hg.openjdk.java.net / jdk7u/jdk7u-dev/jdk/rev/31c782610044

lists.opensuse.org / opensuse-security-announce/2013-05/msg00007.html

lists.opensuse.org / opensuse-security-announce/2013-05/msg00013.html

lists.opensuse.org / opensuse-security-announce/2013-06/msg00001.html

lists.opensuse.org / opensuse-updates/2013-05/msg00017.html

lists.opensuse.org / opensuse-updates/2013-06/msg00099.html

mail.openjdk.java.net / pipermail/distro-pkg-dev/2013-April/022796.html

rhn.redhat.com / errata/RHSA-2013-0752.html

rhn.redhat.com / errata/RHSA-2013-0757.html

rhn.redhat.com / errata/RHSA-2013-0758.html

rhn.redhat.com / errata/RHSA-2013-1455.html

rhn.redhat.com / errata/RHSA-2013-1456.html

bugzilla.redhat.com / show_bug.cgi

security.gentoo.org / glsa/glsa-201406-32.xml

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16297

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19463

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19641

twitter.com / thezdi/status/309784608508100608

wiki.mageia.org / en/Support/Advisories/MGASA-2013-0124

wiki.mageia.org / en/Support/Advisories/MGASA-2013-0130

mandriva.com / security/advisories

mandriva.com / security/advisories

oracle.com / technetwork/topics/security/javacpuapr2013-1928497.html

ubuntu.com / usn/USN-1806-1

us-cert.gov / ncas/alerts/TA13-107A

US Government Resource

zdnet.com / pwn2own-down-go-all-the-browsers-7000012283