CVE-2012-1723criticalunder attackransomwareCWE-284

CVE-2012-1723

Published · Updated

Follow this CVE+ Monitor Oracle Java SE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 94%
from disclosure to weapon25 days
Published on NVDJun 16
1st PoC+25d
metasploitJun 6
CISA KEV+3547d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
16 products (234 components)
Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6) · Red Hat Enterprise Linux Desktop Optional (v. 6) · Red Hat Enterprise Linux Server Optional (v. 6) · and others 11
fix ↗
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

A critical flaw in Oracle Java SE allows remote attackers to compromise computer security through unknown methods in the Hotspot component. This vulnerability affects multiple Java versions and can lead to unauthorized access, data manipulation, or system disruption.

Technical detail

Unspecified remote vulnerability in Oracle Java SE (versions 7u4 and earlier, 6u32 and earlier, 5u35 and earlier, 1.4.2_37 and earlier) within the Hotspot JIT compiler component. Attack vector is network-based with no authentication required; successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.