CVE-2013-4578

5.3 mediumEPSS 2.5%

Medium (5.3) in oracle. EPSS 2.5% chance of exploitation in the next 30 days.

jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.

Severity

CVSS 3.0

5.3 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2017-12-29
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

oracle:jdk
oracle:jre

References

http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d5f36e1c927e
http://www.openwall.com/lists/oss-security/2015/02/08/6
http://www.openwall.com/lists/oss-security/2015/02/09/9
https://access.redhat.com/errata/RHSA-2014:0414
https://bugzilla.redhat.com/show_bug.cgi?id=1031471

Check your stack JSON