cyfenced.com →

[ CVE-2012-0507 · Published 7 Jun 2012 ]

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 98%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-03
  • Known to be used in ransomware campaigns
  • EPSS: 98% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

CISA: An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 24 Mar 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References