CVE-2012-0507 kev+ ransomware in the critical feed json
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier…
published 2012-06-07 14 y ago modified 2026-08-14 2 mo ago also EUVD-2012-0539
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-03-03, used in ransomware
- epss
- 98.2%
- EPSS 98.2% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
Patch / fix
cisa required action Apply updates per vendor instructions.
- java-1.6.0-ibm network satellite 5.4 1:1.6.0.14.0-1jpp.1.el5_9
- java-1.6.0-ibm network satellite 5.4 1:1.6.0.14.0-1jpp.1.el6_4
- java-1.6.0-sun RHEL 4 EXTRAS 1:1.6.0.31-1jpp.1.el4
- java-1.6.0-sun RHEL 5 EXTRAS 1:1.6.0.31-1jpp.1.el5
- java-1.6.0-sun RHEL 6 EXTRAS 1:1.6.0.31-1jpp.1.el6_2
- java-1.6.0-sun-src RHEL 4 EXTRAS 1:1.6.0.31-1jpp.1.el4
- java-1.6.0-sun-src RHEL 5 EXTRAS 1:1.6.0.31-1jpp.1.el5
- java-1.6.0-sun-src RHEL 6 EXTRAS 1:1.6.0.31-1jpp.1.el6_2
red hat advisories RHSA-2013:1455RHSA-2012:0139RHSA-2012:0135RHSA-2012:0514RHSA-2012:0508RHSA-2012:0322
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2012-0507 updated cvss 6.8
OpenJDK: AtomicReferenceArray insufficient array type check (Concurrency, 7082299)
-
Red Hat Enterprise Linux 4 java-1.6.0-sun, java-1.6.0-sun-src, java-1.6.0-sun-demo, java-1.6.0-sun-jdbc, java-1.6.0-sun-javafx, java-1.6.0-sun-pluginaffected: no fix available
-
Red Hat Desktop version 4 Extras java-1.6.0-sun 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-src 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-demo 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-jdbc 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-plugin 1.6.0.31-1jpp.1.el4fixed: vendor fix RHSA-2012:0139
-
Red Hat Enterprise Linux (v. 5 server) java-1.6.0-openjdk 1.6.0.0-1.25.1.10.6.el5_8, java-1.6.0-openjdk-src 1.6.0.0-1.25.1.10.6.el5_8, java-1.6.0-openjdk-demo 1.6.0.0-1.25.1.10.6.el5_8, java-1.6.0-openjdk-javadoc 1.6.0.0-1.25.1.10.6.el5_8fixed: vendor fix RHSA-2012:0322
-
Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-sun 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-src 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-demo 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-jdbc 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-plugin 1.6.0.31-1jpp.1.el4fixed: vendor fix RHSA-2012:0139
-
Red Hat Enterprise Linux Desktop (v. 5 client) java-1.6.0-openjdk 1.6.0.0-1.25.1.10.6.el5_8, java-1.6.0-openjdk-src 1.6.0.0-1.25.1.10.6.el5_8, java-1.6.0-openjdk-demo 1.6.0.0-1.25.1.10.6.el5_8, java-1.6.0-openjdk-javadoc 1.6.0.0-1.25.1.10.6.el5_8fixed: vendor fix RHSA-2012:0322
-
Red Hat Enterprise Linux Desktop (v. 6) java-1.6.0-openjdk 1.6.0.0-1.43.1.10.6.el6_2 Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.6.0-openjdk 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-src 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-demo 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-javadoc 1.6.0.0-1.43.1.10.6.el6_2fixed: vendor fix RHSA-2012:0135
-
Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-sun 1.6.0.31-1jpp.1.el5, java-1.5.0-ibm 1.5.0.13.1-1jpp.1.el5, java-1.6.0-ibm 1.6.0.10.1-1jpp.1.el5, java-1.6.0-sun-src 1.6.0.31-1jpp.1.el5, java-1.6.0-sun-demo 1.6.0.31-1jpp.1.el5, java-1.6.0-sun-jdbc 1.6.0.31-1jpp.1.el5, +13 more Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.6.0-sun 1.6.0.31-1jpp.1.el6_2, java-1.5.0-ibm 1.5.0.13.1-1jpp.2.el6_2, java-1.6.0-ibm 1.6.0.10.1-1jpp.5.el6_2, java-1.6.0-sun-src 1.6.0.31-1jpp.1.el6_2, java-1.6.0-sun-demo 1.6.0.31-1jpp.1.el6_2, java-1.6.0-sun-jdbc 1.6.0.31-1jpp.1.el6_2, +11 more Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-sun 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-src 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-demo 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-jdbc 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-plugin 1.6.0.31-1jpp.1.el4fixed: vendor fix RHSA-2012:0139
-
Red Hat Enterprise Linux HPC Node (v. 6) java-1.6.0-openjdk 1.6.0.0-1.43.1.10.6.el6_2 Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.6.0-openjdk 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-src 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-demo 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-javadoc 1.6.0.0-1.43.1.10.6.el6_2fixed: vendor fix RHSA-2012:0135
show 6 moreshow fewer
-
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.6.0-sun 1.6.0.31-1jpp.1.el6_2, java-1.5.0-ibm 1.5.0.13.1-1jpp.2.el6_2, java-1.6.0-ibm 1.6.0.10.1-1jpp.5.el6_2, java-1.6.0-sun-src 1.6.0.31-1jpp.1.el6_2, java-1.6.0-sun-demo 1.6.0.31-1jpp.1.el6_2, java-1.5.0-ibm-src 1.5.0.13.1-1jpp.2.el6_2, +5 morefixed: vendor fix RHSA-2012:0139
-
Red Hat Enterprise Linux Server (v. 6) java-1.6.0-openjdk 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-javadoc 1.6.0.0-1.43.1.10.6.el6_2 Red Hat Enterprise Linux Server Optional (v. 6) java-1.6.0-openjdk 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-src 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-demo 1.6.0.0-1.43.1.10.6.el6_2fixed: vendor fix RHSA-2012:0135
-
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-sun 1.6.0.31-1jpp.1.el5, java-1.5.0-ibm 1.5.0.13.1-1jpp.1.el5, java-1.6.0-ibm 1.6.0.10.1-1jpp.1.el5, java-1.6.0-sun-src 1.6.0.31-1jpp.1.el5, java-1.6.0-sun-demo 1.6.0.31-1jpp.1.el5, java-1.6.0-sun-jdbc 1.6.0.31-1jpp.1.el5, +13 more Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.6.0-sun 1.6.0.31-1jpp.1.el6_2, java-1.5.0-ibm 1.5.0.13.1-1jpp.2.el6_2, java-1.6.0-ibm 1.6.0.10.1-1jpp.5.el6_2, java-1.6.0-sun-src 1.6.0.31-1jpp.1.el6_2, java-1.6.0-sun-demo 1.6.0.31-1jpp.1.el6_2, java-1.6.0-sun-jdbc 1.6.0.31-1jpp.1.el6_2, +11 morefixed: vendor fix RHSA-2012:0139
-
Red Hat Enterprise Linux Workstation (v. 6) java-1.6.0-openjdk 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-javadoc 1.6.0.0-1.43.1.10.6.el6_2 Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.6.0-openjdk 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-src 1.6.0.0-1.43.1.10.6.el6_2, java-1.6.0-openjdk-demo 1.6.0.0-1.43.1.10.6.el6_2fixed: vendor fix RHSA-2012:0135
-
Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.6.0-sun 1.6.0.31-1jpp.1.el6_2, java-1.5.0-ibm 1.5.0.13.1-1jpp.2.el6_2, java-1.6.0-ibm 1.6.0.10.1-1jpp.5.el6_2, java-1.6.0-sun-src 1.6.0.31-1jpp.1.el6_2, java-1.6.0-sun-demo 1.6.0.31-1jpp.1.el6_2, java-1.6.0-sun-jdbc 1.6.0.31-1jpp.1.el6_2, +11 more Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-sun 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-src 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-demo 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-jdbc 1.6.0.31-1jpp.1.el4, java-1.6.0-sun-plugin 1.6.0.31-1jpp.1.el4fixed: vendor fix RHSA-2012:0139
-
Red Hat Satellite 5.4 (RHEL v.5) java-1.6.0-ibm 1.6.0.14.0-1jpp.1.el5_9 Red Hat Satellite 5.4 (RHEL v.6) java-1.6.0-ibm 1.6.0.14.0-1jpp.1.el6_4fixed: vendor fix RHSA-2013:1455
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (Metasploit exploit/multi/browser/java_atomicreferencearray)
- Published
- CISA SSVC: exploitation active
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 4 y ago
- Patch by
- 2022-03-24 (4 y ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Oracle, Java SE
- CISA name
- Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 4 y ago
Exploit prediction
98.19% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/multi/browser/java_atomicreferencearray Java AtomicReferenceArray Type Violation Vulnerability metasploit exploit, excellent rank, 2012-02-14
- EDB-18679 Java - AtomicReferenceArray Type Violation (Metasploit) remote, 2012-03-30
- weblog.ikvm.net http://weblog.ikvm.net/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3 referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/52161 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-843 Access of Resource Using Incompatible Type
References
-
weblog.ikvm.net
/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3
broken-link, exploit
-
securityfocus.com
/bid/52161
vdb-entry, broken-link, exploit, third-party-advisory
-
marc.info
/?l=bugtraq&m=133847939902305&w=2
vendor-advisory, third-party-advisory
-
marc.info
/?l=bugtraq&m=134254866602253&w=2
vendor-advisory, third-party-advisory
-
marc.info
/?l=bugtraq&m=133365109612558&w=2
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2012-05/msg00009.html
vendor-advisory, issue-tracking, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2013-1455.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2012-05/msg00010.html
vendor-advisory, mailing-list, third-party-advisory
-
marc.info
/?l=bugtraq&m=133364885411663&w=2
vendor-advisory, third-party-advisory
-
debian.org
/security/2012/dsa-2420
vendor-advisory, mailing-list, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2012-0508.html
vendor-advisory, third-party-advisory
-
marc.info
/?l=bugtraq&m=134254957702612&w=2
vendor-advisory, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2012-0514.html
vendor-advisory, third-party-advisory
-
oracle.com
/technetwork/topics/security/javacpufeb2012-366318.html
vendor-advisory
-
secunia.com
/advisories/48692
third-party-advisory, broken-link, not-applicable
-
krebsonsecurity.com
/2012/03/new-java-attack-rolled-into-exploit-packs/
third-party-advisory
-
secunia.com
/advisories/48589
third-party-advisory, broken-link, not-applicable
-
secunia.com
/advisories/48950
third-party-advisory, broken-link, not-applicable
-
secunia.com
/advisories/48948
third-party-advisory, broken-link, not-applicable
-
blogs.technet.com
/b/mmpc/archive/2012/03/20/an-interesting-case-of-jre-sandbox-breach-cve-2012-0507.aspx
broken-link, third-party-advisory
-
secunia.com
/advisories/48915
third-party-advisory, broken-link, not-applicable
-
bugzilla.redhat.com
/show_bug.cgi?id=788994
issue-tracking
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0507
government-resource, us-government-resource
Sources
- CVE List CVE-2012-0507
- NVD CVE-2012-0507
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.