---
title: "CVE-2013-1489\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2013-1489?format=md
keywords: index, follow
---

# CVE-2013-1489

Publication date 31 January 2013

Last updated 24 July 2024

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component
in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using
Internet Explorer, Firefox, Opera, and Google Chrome, allows remote
attackers to bypass the "Very High" security level of the Java Control
Panel and execute unsigned Java code without prompting the user via unknown
vectors, aka "Issue 53" and the "Java Security Slider" vulnerability.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2013-1489?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| openjdk-7 | 12.10 quantal | Not affected |
| 12.04 LTS precise | Not affected |
| 11.10 oneiric | Not affected |
| 10.04 LTS lucid | Not in release |
| 8.04 LTS hardy | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

in lucid+, NetX and the plugin moved to the icedtea-web package

---

### [jdstrand](https://launchpad.net/~jdstrand)

openjdk-6b18 FTBFS on 11.04 (LP: #1043003)
Windows-only

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1489)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-1489)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2013-1489)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2013-1489)

### Other references

* <http://www.zdnet.com/java-update-doesnt-prevent-silent-exploits-at-all-7000010422/>
* <http://www.scmagazine.com.au/News/330453,java-still-unsafe-new-flaws-discovered.aspx>
* <http://www.informationweek.com/security/application-security/java-security-work-remains-bug-hunter-sa/240147150>
* <http://thenextweb.com/insider/2013/01/28/new-vulnerability-bypasses-oracles-attempt-to-stop-malware-drive-by-downloads-via-java-applets/>
* <http://seclists.org/fulldisclosure/2013/Jan/241>
* <http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53>
* <https://www.cve.org/CVERecord?id=CVE-2013-1489>