CVE-2012-0507
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution
- Published7 Jun 2012
- Added to CISA KEV3 Mar 2022
- Remediation due24 Mar 2022
Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
Remediation
No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.
References
- http://blogs.technet.com/b/mmpc/archive/2012/03/20/an-interesting-case-of-jre-sandbox-breach-cve-2012-0507.aspx
- http://krebsonsecurity.com/2012/03/new-java-attack-rolled-into-exploit-packs/
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00010.html
- http://marc.info/?l=bugtraq&m=133364885411663&w=2
- http://marc.info/?l=bugtraq&m=133365109612558&w=2
- http://marc.info/?l=bugtraq&m=133847939902305&w=2
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://marc.info/?l=bugtraq&m=134254957702612&w=2
- http://rhn.redhat.com/errata/RHSA-2012-0508.html
and 13 more references
Related CVEs
Recent high-severity vulnerabilities sharing a weakness type.
Frequently asked
Is CVE-2012-0507 being actively exploited?
Yes. CVE-2012-0507 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Mar 2022. It has been used in ransomware campaigns.
How severe is CVE-2012-0507?
CVE-2012-0507 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 98.1% probability of exploitation.
Which products are affected by CVE-2012-0507?
Affected products include Oracle Jre, Sun Jre, Debian Linux, Suse Linux Enterprise Desktop, Suse Linux Enterprise Java, and 2 more.
How do I fix CVE-2012-0507?
Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2012-0507 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.