CVE-2012-5076criticalunder attackCWE-284

CVE-2012-5076

Published · Updated

Follow this CVE+ Monitor Oracle Java SE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 91%
from disclosure to weapon28 days
Published on NVDOct 16
1st PoC+28d
metasploitOct 16
CISA KEV+3450d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (9 components)
Red Hat Enterprise Linux 5
none_available: Affected
Fixed
12 products (144 components)
Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6) · Red Hat Enterprise Linux Desktop Optional (v. 6) · Red Hat Enterprise Linux HPC Node Supplementary (v. 6) · and others 7
fix ↗
Not affected
2 products (20 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2022-04-18

Apply updates per vendor instructions.

In short

A flaw in Java SE 7 Update 7's JAX-WS component allows remote attackers to compromise your computer without authentication, risking theft of data, unauthorized changes, or system crashes.

Technical detail

An unspecified vulnerability in the JAX-WS component of Oracle Java SE 7 Update 7 and earlier permits remote code execution or privilege escalation through crafted network requests, affecting confidentiality, integrity, and availability without requiring local access or user interaction.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.