CVE-2012-1723KEV Β· OVERDUECWE-284broken-access-control

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Critical Β· published June 17, 2012

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1673
days past CISA
deadline
CVSS v3.1
9.8
EPSS
94%
Percentile
99.8
In the wild
Confirmed
What it is

🚨 A sneaky unknown flaw in Java Runtime Environment could give attackers the keys to your kingdom! πŸ”₯ Think of this like a restaurant where the chef accidentally left a back door unlocked. While the patrons enjoy their meals, anyone from the street could stroll in, tamper with the kitchen, or even just snack on the leftovers without being noticed. This vulnerability can allow attackers to mess with your data, causing absolute chaos! They could potentially gain unauthorized access, steal sensitive information, or even take down your entire system. The consequences could be devastating for both integrity and availability of your services.

Put simply

Think of this like a restaurant where the chef accidentally left a back door unlocked. While the patrons enjoy their meals, anyone from the street could stroll in, tamper with the kitchen, or even just snack on the leftovers without being noticed. This unspecified vulnerability affects multiple versions of Oracle Java SE, and it arises from unknown vectors related to Hotspot, making it particularly sneaky and dangerous. Attackers can exploit it remotely, without any authentication needed.

What to do

This vulnerability can allow attackers to mess with your data, causing absolute chaos! They could potentially gain unauthorized access, steal sensitive information, or even take down your entire system. The consequences could be devastating for both integrity and availability of your services. Immediately update your Java Runtime Environment to the latest version available. If you’re using versions 7 or earlier, 6 update 32 or earlier, or 5 update 35 or earlier, it’s crucial to patch these systems right away to mitigate risk. Don't forget to review your security policies and ensure you have robust monitoring in place. You've got this! With prompt action, you can keep your systems safe and sound. πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
9.8 Β· CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.93566 Β· 99.8th percentile
Weakness
CWE-284 Β· Improper Access Control
Published
2012-06-17T01:55Z
KEV added
2022-03-03 Β· due 2022-03-24
Affected products (136)
ProductVersionsFixed in
oracle/jdk≀ 1.4.2_37β€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jre≀ 1.4.2_37β€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
redhat/icedtea6< 1.10.81.10.8
redhat/icedtea6β‰₯ 1.11.0, < 1.11.31.11.3
redhat/enterprise_linux_desktopall versionsβ€”
redhat/enterprise_linux_desktopall versionsβ€”
redhat/enterprise_linux_eusall versionsβ€”
redhat/enterprise_linux_serverall versionsβ€”
redhat/enterprise_linux_serverall versionsβ€”
redhat/enterprise_linux_server_ausall versionsβ€”
redhat/enterprise_linux_workstationall versionsβ€”
redhat/enterprise_linux_workstationall versionsβ€”
References (21)
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-June/019076.html Β· [email protected]http://marc.info/?l=bugtraq&m=134496371727681&w=2 Β· [email protected]http://rhn.redhat.com/errata/RHSA-2012-0734.html Β· [email protected]http://secunia.com/advisories/51080 Β· [email protected]http://security.gentoo.org/glsa/glsa-201406-32.xml Β· [email protected]http://www.ibm.com/support/docview.wss?uid=swg21615246 Β· [email protected]http://www.mandriva.com/security/advisories?name=MDVSA-2012:095 Β· [email protected]http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html Β· [email protected]http://www.securityfocus.com/bid/53960 Β· [email protected]https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16259 Β· [email protected]http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-June/019076.html Β· af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=134496371727681&w=2 Β· af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2012-0734.html Β· af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/51080 Β· af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-201406-32.xml Β· af854a3a-2127-422b-91ae-364da2661108http://www.ibm.com/support/docview.wss?uid=swg21615246 Β· af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2012:095 Β· af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html Β· af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/53960 Β· af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16259 Β· af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1723 Β· 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV β€” remediate by Mar 24
    kev
  • 16 JUN 21:00Z
    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and…
    cvelistv5