critical 9.8

CVE-2012-1723 kev+ ransomware in the critical feed json

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier…

published 2012-06-16 14 y ago modified 2026-08-06 3 mo ago also EUVD-2012-1733

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-03-03, used in ransomware
epss: 93.6%; EPSS 93.6% chance of exploitation in 30 days, percentile 99.8%
public exploits: 2; Metasploit, Exploit-DB

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 9 distros 2

oracle java_se 1.6.0_33, 1.7.0_5, 6.0.33, 7.0.5
oracle jdk 1.6.0_33, 1.7.0_5, 6.0.33, 7.0.5
oracle jre 1.6.0_33, 1.7.0_5, 6.0.33, 7.0.5
sun java 1.6.0_33, 1.7.0_5, 6.0.33, 7.0.5
sun java_se 1.6.0_33, 1.7.0_5, 6.0.33, 7.0.5
sun jdk 1.6.0_33, 1.7.0_5, 6.0.33, 7.0.5
sun jre 1.6.0_33, 1.7.0_5, 6.0.33, 7.0.5
oracle openjdk 1.6.0_33, 1.7.0_5, 6.0.33, 7.0.5
sun openjdk 1.6.0_33, 1.7.0_5, 6.0.33, 7.0.5

red hat opensuse

java-1.6.0-openjdk RHEL 5 1:1.6.0.0-1.27.1.10.8.el5_8
java-1.6.0-openjdk-src RHEL 5 1:1.6.0.0-1.27.1.10.8.el5_8
java-1.6.0-openjdk-demo RHEL 5 1:1.6.0.0-1.27.1.10.8.el5_8
java-1.6.0-openjdk-javadoc RHEL 5 1:1.6.0.0-1.27.1.10.8.el5_8
java-1.6.0-openjdk RHEL 6 1:1.6.0.0-1.48.1.11.3.el6_2
java-1.6.0-openjdk-src RHEL 6 1:1.6.0.0-1.48.1.11.3.el6_2
java-1.6.0-openjdk-demo RHEL 6 1:1.6.0.0-1.48.1.11.3.el6_2
java-1.6.0-openjdk-javadoc RHEL 6 1:1.6.0.0-1.48.1.11.3.el6_2

red hat advisories RHSA-2012:0730 RHSA-2012:0729 RHSA-2012:1019 RHSA-2012:1009 RHSA-2012:0734

java-1_7_0-openjdk openSUSE Tumbleweed 1.7.0.121-1.1

opensuse advisories openSUSE-SU-2024:10534-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-1723 updated 2026-06-28 cvss 6.8

OpenJDK: insufficient field accessibility checks (HotSpot, 7152811)

Red Hat Enterprise Linux (v. 5 server) java-1.6.0-openjdk 1.6.0.0-1.27.1.10.8.el5_8, java-1.6.0-openjdk-src 1.6.0.0-1.27.1.10.8.el5_8, java-1.6.0-openjdk-demo 1.6.0.0-1.27.1.10.8.el5_8, java-1.6.0-openjdk-javadoc 1.6.0.0-1.27.1.10.8.el5_8 Red Hat Enterprise Linux Desktop (v. 5 client) java-1.6.0-openjdk 1.6.0.0-1.27.1.10.8.el5_8, java-1.6.0-openjdk-src 1.6.0.0-1.27.1.10.8.el5_8, java-1.6.0-openjdk-demo 1.6.0.0-1.27.1.10.8.el5_8, java-1.6.0-openjdk-javadoc 1.6.0.0-1.27.1.10.8.el5_8
fixed: vendor fix RHSA-2012:0730
Red Hat Enterprise Linux Desktop (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.48.1.11.3.el6_2 Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3, java-1.7.0-openjdk-src 1.7.0.5-2.2.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.48.1.11.3.el6_2, java-1.7.0-openjdk-javadoc 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk-src 1.6.0.0-1.48.1.11.3.el6_2, +2 more
fixed: vendor fix RHSA-2012:0729
Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-sun 1.6.0.33-1jpp.1.el5_8, java-1.6.0-sun-src 1.6.0.33-1jpp.1.el5_8, java-1.6.0-sun-demo 1.6.0.33-1jpp.1.el5_8, java-1.6.0-sun-jdbc 1.6.0.33-1jpp.1.el5_8, java-1.6.0-sun-plugin 1.6.0.33-1jpp.1.el5_8 Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.6.0-sun 1.6.0.33-1jpp.1.el6_2, java-1.7.0-oracle 1.7.0.5-1jpp.1.el6, java-1.6.0-sun-src 1.6.0.33-1jpp.1.el6_2, java-1.7.0-oracle-src 1.7.0.5-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.33-1jpp.1.el6_2, java-1.6.0-sun-jdbc 1.6.0.33-1jpp.1.el6_2, +3 more
fixed: vendor fix RHSA-2012:0734
Red Hat Enterprise Linux HPC Node (v. 6) java-1.6.0-openjdk 1.6.0.0-1.48.1.11.3.el6_2 Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3, java-1.7.0-openjdk-src 1.7.0.5-2.2.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.48.1.11.3.el6_2, java-1.7.0-openjdk-javadoc 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk-src 1.6.0.0-1.48.1.11.3.el6_2, +2 more
fixed: vendor fix RHSA-2012:0729
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.6.0-sun 1.6.0.33-1jpp.1.el6_2, java-1.7.0-oracle 1.7.0.5-1jpp.1.el6, java-1.6.0-sun-src 1.6.0.33-1jpp.1.el6_2, java-1.7.0-oracle-src 1.7.0.5-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.33-1jpp.1.el6_2
fixed: vendor fix RHSA-2012:0734
Red Hat Enterprise Linux Server (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.48.1.11.3.el6_2, java-1.6.0-openjdk-javadoc 1.6.0.0-1.48.1.11.3.el6_2 Red Hat Enterprise Linux Server Optional (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3, java-1.7.0-openjdk-src 1.7.0.5-2.2.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.48.1.11.3.el6_2, java-1.7.0-openjdk-javadoc 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk-src 1.6.0.0-1.48.1.11.3.el6_2, +1 more
fixed: vendor fix RHSA-2012:0729
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-sun 1.6.0.33-1jpp.1.el5_8, java-1.6.0-sun-src 1.6.0.33-1jpp.1.el5_8, java-1.6.0-sun-demo 1.6.0.33-1jpp.1.el5_8, java-1.6.0-sun-jdbc 1.6.0.33-1jpp.1.el5_8, java-1.6.0-sun-plugin 1.6.0.33-1jpp.1.el5_8 Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.6.0-sun 1.6.0.33-1jpp.1.el6_2, java-1.7.0-oracle 1.7.0.5-1jpp.1.el6, java-1.6.0-sun-src 1.6.0.33-1jpp.1.el6_2, java-1.7.0-oracle-src 1.7.0.5-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.33-1jpp.1.el6_2, java-1.6.0-sun-jdbc 1.6.0.33-1jpp.1.el6_2, +3 more
fixed: vendor fix RHSA-2012:0734
Red Hat Enterprise Linux Workstation (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.48.1.11.3.el6_2, java-1.6.0-openjdk-javadoc 1.6.0.0-1.48.1.11.3.el6_2 Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3, java-1.7.0-openjdk-src 1.7.0.5-2.2.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.48.1.11.3.el6_2, java-1.7.0-openjdk-javadoc 1.7.0.5-2.2.1.el6_3, java-1.6.0-openjdk-src 1.6.0.0-1.48.1.11.3.el6_2, +1 more
fixed: vendor fix RHSA-2012:0729

show 1 more

Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.6.0-sun 1.6.0.33-1jpp.1.el6_2, java-1.7.0-oracle 1.7.0.5-1jpp.1.el6, java-1.6.0-sun-src 1.6.0.33-1jpp.1.el6_2, java-1.7.0-oracle-src 1.7.0.5-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.33-1jpp.1.el6_2, java-1.6.0-sun-jdbc 1.6.0.33-1jpp.1.el6_2, +3 more
fixed: vendor fix RHSA-2012:0734

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2012-06-06 First public exploit (Metasploit exploit/multi/browser/java_verifier_field_access)
2012-06-16 Published
2022-03-03 CISA SSVC: exploitation active
2022-03-03 Added to CISA KEV
2022-03-24 CISA patch deadline

Known exploited

Added: 4 y ago (2022-03-03)
Patch by: 2022-03-24 (4 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: Oracle, Java SE
CISA name: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 4 y ago (2022-03-03)

Exploit prediction

93.57% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/multi/browser/java_verifier_field_access Java Applet Field Bytecode Verifier Cache Remote Code Execution metasploit exploit, excellent rank, 2012-06-06
EDB-19717 Java Applet - Field Bytecode Verifier Cache Remote Code Execution (Metasploit) remote, 2012-07-11

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-284 Improper Access Control

References

security.gentoo.org /glsa/glsa-201406-32.xml
vendor-advisory, third-party-advisory
rhn.redhat.com /errata/RHSA-2012-0734.html
vendor-advisory, third-party-advisory
marc.info /?l=bugtraq&m=134496371727681&w=2
vendor-advisory, mailing-list
mandriva.com /security/advisories?name=MDVSA-2012:095
vendor-advisory, broken-link
oracle.com /technetwork/topics/security/javacpujun2012-1515912.html
vendor-advisory
mail.openjdk.java.net /pipermail/distro-pkg-dev/2012-June/019076.html
mailing-list
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16259
vdb-entry, signature, broken-link
securityfocus.com /bid/53960
vdb-entry, broken-link, third-party-advisory
ibm.com /support/docview.wss?uid=swg21615246
broken-link
secunia.com /advisories/51080
third-party-advisory, broken-link
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1723
government-resource, us-government-resource

Sources

CVE List CVE-2012-1723
NVD CVE-2012-1723

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Updated Java versions.

Summary