Oracle Java SE Sandbox Bypass Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-28
• EPSS: 91% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.

CISA: The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 18 Apr 2022): Apply updates per vendor instructions.

• Patch on oracle.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.htmlMailing ListThird Party Advisory
• rhn.redhat.com/errata/RHSA-2012-1386.htmlThird Party Advisory
• rhn.redhat.com/errata/RHSA-2012-1391.htmlThird Party Advisory
• rhn.redhat.com/errata/RHSA-2012-1467.htmlThird Party Advisory
• secunia.com/advisories/51029Not Applicable
• secunia.com/advisories/51326Not Applicable
• secunia.com/advisories/51390Not Applicable
• security.gentoo.org/glsa/glsa-201406-32.xmlThird Party Advisory
• www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.htmlPatchVendor Advisory
• oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16641Broken Link
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource