CVE-2013-5907

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 5.0u55, 6u65, and 7u45 JRockit versions R27.7.7 and R28.2.9 Java SE Embedded version 7u45 OpenJDK version 7

Description The issue affects confidentiality, integrity, and availability via unknown vectors related to 2D. It is reportedly due to incorrect input validation in the ICU Layout Engine, which allows attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file.

Recommendations For Oracle Java SE versions 5.0u55, 6u65, and 7u45, update to a version that is not affected by this issue. For JRockit versions R27.7.7 and R28.2.9, update to a version that is not affected by this issue. For Java SE Embedded version 7u45, update to a version that is not affected by this issue. For OpenJDK version 7, update to a version that is not affected by this issue. As a temporary workaround, consider disabling the use of crafted font files to minimize the risk of exploitation.