9.8Kritisch KEV In Ransomware genutzt

CVE-2012-4681Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

oracle jdk; oracle jre; redhat enterprise linux desktop; redhat enterprise linux eus Veröffentlicht: 2012-08-28 03:00 (vor 14 Jahren)

Bekannt ausgenutzt — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

CISA hat am 03.03.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 24.03.2022.

Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2012-4681

Beschreibung

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Schwachstellentyp (CWE): CWE-284

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
oracle	jdk	1.6.0
oracle	jre	1.6.0
redhat	enterprise linux desktop	6.0
redhat	enterprise linux eus	6.3
redhat	enterprise linux server	6.0
redhat	enterprise linux workstation	6.0

Referenzen und Patches

http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html Third Party Advisory
SUSE-SU-2012:1398 vendor-advisoryMailing List
SUSE-SU-2012:1231 vendor-advisoryMailing List
TA12-240A third-party-advisoryThird Party AdvisoryUS Government Resource
http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/ Broken LinkExploit
SSRT100970 vendor-advisoryIssue TrackingMailing ListThird Party Advisory
https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day Broken LinkThird Party Advisory
http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html Broken LinkThird Party Advisory
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html Vendor Advisory
RHSA-2012:1225 vendor-advisoryThird Party Advisory
http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html ExploitThird Party Advisory
51044 third-party-advisoryNot Applicable
55213 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4681 US Government Resource

CPE-Treffer (NVD) (60)

cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update15:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update16:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update17:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update18:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update19:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update20:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update21:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update27:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update29:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update30:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update31:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update32:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update33:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update34:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update4:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update5:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update6:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update7:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update8:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update9:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:-:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:-:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update1:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update10:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update11:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update12:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update13:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update14:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update15:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update16:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update17:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update18:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update19:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update2:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update20:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update21:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*

CVSS-Score

9.8Kritisch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	9.8Kritisch
nvd	CVSS 3.1	9.8Kritisch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Kritisch
nvd	CVSS 2.0	10.0Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

98.54%

höher als 100 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2012-08-27
Veröffentlicht2012-08-28 03:00
Bei IP-DB eingegangen2026-10-24 23:34
In KEV aufgenommen2022-03-03
Zuletzt aktualisiert2026-08-06 08:16

Vergeben von (CNA): mitre
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Java SE / OpenJDK

9.1Kritisch

CVE-2026-114820 vor 20 Tagen

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.…

9.1Kritisch

CVE-2026-91403 vor 23 Tagen

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1;…

4.8Mittel

CVE-2026-91487 vor 24 Tagen

Oracle Corporation Oracle Java SE

Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21…

7.5Hoch

CVE-2026-91484 vor 24 Tagen

Oracle Corporation Oracle Java SE

Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE …

5.9Mittel

CVE-2026-91462 vor 24 Tagen

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1,…

5.3Mittel

CVE-2026-91463 vor 24 Tagen

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition