CVE-2012-0507 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to af...
HighCVSS 10.0
EPSS 98.2%
CISA KEV
added 2022-03-03 · due 2022-03-24
Ransomware
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-03
- Due date (FCEB)
- 2022-03-24
- Ransomware use
- Known
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun jre | = 1.5.0 | No fix listed |
| sun jre | = 1.5.0-update1 | No fix listed |
| sun jre | = 1.5.0-update10 | No fix listed |
| sun jre | = 1.5.0-update11 | No fix listed |
| sun jre | = 1.5.0-update12 | No fix listed |
| sun jre | = 1.5.0-update13 | No fix listed |
| sun jre | = 1.5.0-update14 | No fix listed |
| sun jre | = 1.5.0-update15 | No fix listed |
| sun jre | = 1.5.0-update16 | No fix listed |
| sun jre | = 1.5.0-update17 | No fix listed |
| sun jre | = 1.5.0-update18 | No fix listed |
| sun jre | = 1.5.0-update19 | No fix listed |
| sun jre | = 1.5.0-update2 | No fix listed |
| sun jre | = 1.5.0-update20 | No fix listed |
| sun jre | = 1.5.0-update21 | No fix listed |
| sun jre | = 1.5.0-update22 | No fix listed |
| sun jre | = 1.5.0-update23 | No fix listed |
| sun jre | = 1.5.0-update24 | No fix listed |
| sun jre | = 1.5.0-update25 | No fix listed |
| sun jre | = 1.5.0-update26 | No fix listed |
| sun jre | = 1.5.0-update27 | No fix listed |
| sun jre | = 1.5.0-update28 | No fix listed |
| sun jre | = 1.5.0-update29 | No fix listed |
| sun jre | = 1.5.0-update3 | No fix listed |
| sun jre | = 1.5.0-update31 | No fix listed |
Show 48 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sun jre | = 1.5.0-update33 | No fix listed |
| sun jre | = 1.5.0-update4 | No fix listed |
| sun jre | = 1.5.0-update5 | No fix listed |
| sun jre | = 1.5.0-update6 | No fix listed |
| sun jre | = 1.5.0-update7 | No fix listed |
| sun jre | = 1.5.0-update8 | No fix listed |
| sun jre | = 1.5.0-update9 | No fix listed |
| sun jre | = 1.6.0 | No fix listed |
| sun jre | = 1.6.0-update_1 | No fix listed |
| sun jre | = 1.6.0-update_10 | No fix listed |
| sun jre | = 1.6.0-update_11 | No fix listed |
| sun jre | = 1.6.0-update_12 | No fix listed |
| sun jre | = 1.6.0-update_13 | No fix listed |
| sun jre | = 1.6.0-update_14 | No fix listed |
| sun jre | = 1.6.0-update_15 | No fix listed |
| sun jre | = 1.6.0-update_16 | No fix listed |
| sun jre | = 1.6.0-update_17 | No fix listed |
| sun jre | = 1.6.0-update_18 | No fix listed |
| sun jre | = 1.6.0-update_19 | No fix listed |
| sun jre | = 1.6.0-update_2 | No fix listed |
| sun jre | = 1.6.0-update_20 | No fix listed |
| sun jre | = 1.6.0-update_21 | No fix listed |
| sun jre | = 1.6.0-update_3 | No fix listed |
| sun jre | = 1.6.0-update_4 | No fix listed |
| sun jre | = 1.6.0-update_5 | No fix listed |
| sun jre | = 1.6.0-update_6 | No fix listed |
| sun jre | = 1.6.0-update_7 | No fix listed |
| oracle jre | = 1.6.0-update22 | No fix listed |
| oracle jre | = 1.6.0-update23 | No fix listed |
| oracle jre | = 1.6.0-update24 | No fix listed |
| oracle jre | = 1.6.0-update25 | No fix listed |
| oracle jre | = 1.6.0-update26 | No fix listed |
| oracle jre | = 1.6.0-update27 | No fix listed |
| oracle jre | = 1.6.0-update29 | No fix listed |
| oracle jre | = 1.6.0-update30 | No fix listed |
| oracle jre | = 1.7.0 | No fix listed |
| oracle jre | = 1.7.0-update1 | No fix listed |
| oracle jre | = 1.7.0-update2 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| SUSE linux enterprise desktop | = 10-sp4 | No fix listed |
| SUSE linux enterprise java | = 10-sp4 | No fix listed |
| SUSE linux enterprise java | = 11-sp1 | No fix listed |
| SUSE linux enterprise server | = 10-sp4 | No fix listed |
| SUSE linux enterprise server | = 11-sp1 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp1 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp2 | No fix listed |
References
- HPSBUX02784 third-party-advisory vendor-advisory
- www.oracle.com vendor-advisory
- 48692 broken-link not-applicable third-party-advisory
- HPSBMU02799 third-party-advisory vendor-advisory
- krebsonsecurity.com third-party-advisory
- 48589 broken-link not-applicable third-party-advisory
- SSRT100805 third-party-advisory vendor-advisory
- weblog.ikvm.net broken-link exploit
- SUSE-SU-2012:0602 issue-tracking third-party-advisory vendor-advisory
- RHSA-2013:1455 third-party-advisory vendor-advisory
- SUSE-SU-2012:0603 mailing-list third-party-advisory vendor-advisory
- 48950 broken-link not-applicable third-party-advisory
- 48948 broken-link not-applicable third-party-advisory
- blogs.technet.com broken-link third-party-advisory
- 48915 broken-link not-applicable third-party-advisory
- HPSBUX02757 third-party-advisory vendor-advisory
- DSA-2420 mailing-list third-party-advisory vendor-advisory
- RHSA-2012:0508 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking
- SSRT100867 third-party-advisory vendor-advisory
- RHSA-2012:0514 third-party-advisory vendor-advisory
- 52161 broken-link exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource