from disclosure to weaponsame day
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Affected1 product (7 components)
Red Hat Enterprise Linux 4
none_available: Affected
Fixed22 products (434 components)
Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Desktop Supplementary (v. 5) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6) · and others 17
Action required by CISAfederal deadline: 2022-03-24
Apply updates per vendor instructions.
In short
A flaw in Java's concurrent programming tools (AtomicReferenceArray) allows attackers to crash the Java application or escape the security sandbox, compromising the system's confidentiality, integrity, and availability.
Technical detail
The AtomicReferenceArray class in Java SE 7 Update 2 and earlier fails to validate array type, permitting remote attackers to trigger JVM crashes or bypass Java sandbox restrictions through specially crafted concurrent operations; exploitation requires network access to execute Java code (applets or JNLP).
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.