CVE-2012-4416
published 2012-10-16CVE-2012-4416: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote…
PriorityP340medium6.4CVSS 2.0
AVNACLAuNCPIPAN
EPSS
3.39%
87.5th percentile
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Hotspot.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | jdk | <= 1.7.0 | — |
| oracle | jdk | <= 1.6.0 | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | <= 1.7.0 | — |
| oracle | jre | <= 1.6.0 | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jre | — | — |
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vendor_ubuntu10.0CRITICAL
vendor_redhat6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK vulnerabilities
vendor_ubuntu·2012-10-26·CVSS 10.0
CVE-2012-1531 [CRITICAL] OpenJDK vulnerabilities
Title: OpenJDK vulnerabilities
Summary: Several security issues were fixed in OpenJDK.
Several information disclosure vulnerabilities were discovered in the
OpenJDK JRE. (CVE-2012-3216, CVE-2012-5069, CVE-2012-5072, CVE-2012-5075,
CVE-2012-5077, CVE-2012-5085)
Vulnerabilities were discovered in the OpenJDK JRE related to information
disclosure and data integrity. (CVE-2012-4416, CVE-2012-5071)
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to cause a denial of service. (CVE-2012-1531, CVE-2012-1532, CVE-2012-1533,
CVE-2012-3143, CVE-2012-3159, CVE-2012-5068, CVE-2012-5083, CVE-2012-5084,
CVE-2012-5086, CVE-2012-5089)
Information disclosure vulnerabilities were discovered in the OpenJDK JR
Red Hat
OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606)
vendor_redhat·2012-09-07·CVSS 6.4
CVE-2012-4416 [MEDIUM] OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606)
OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Hotspot.
Package: java-1.4.2-ibm (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.5.0-ibm (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.6.0-ibm (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.7.0-ibm (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.7.0-openjdk (Red Hat Enterprise Linux 5) - Affected
Package: java-1.7.0-oracle (Red Hat Enterprise Linux 5) - Affected
Package: java-1.5.0-ibm (Red Hat Enterprise Linux 6) - Not affecte
Red Hat
java-1.7.0-openjdk: JVM heap memory disclosure
vendor_redhat·2012-09-07·CVSS 6.4
CVE-2012-4420 [MEDIUM] java-1.7.0-openjdk: JVM heap memory disclosure
java-1.7.0-openjdk: JVM heap memory disclosure
An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.
Statement: This flaw was found to be a duplicate of CVE-2012-4416. Please see https://access.redhat.com/security/cve/CVE-2012-4416 for information about affected products and security errata.
Package: java-1.4.2-ibm (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.4.2-ibm-sap (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.5.0-ibm (Red Hat Enterprise Linux 5)
GHSA
GHSA-56m8-96wp-75pp: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allow
ghsa_unreviewed·2022-05-14
CVE-2012-4416 [MEDIUM] GHSA-56m8-96wp-75pp: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allow
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Hotspot.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-4420 java-1.7.0-openjdk: JVM heap memory disclosure
bugzilla·2012-09-12·CVSS 6.4
CVE-2012-4420 [MEDIUM] CVE-2012-4420 java-1.7.0-openjdk: JVM heap memory disclosure
CVE-2012-4420 java-1.7.0-openjdk: JVM heap memory disclosure
An information disclosure flaw was found in the way Java Virtual Machine (JVM) implemenation of Java SE 7 as provided by OpenJDK 7, used to initialize integer arrays (they have had nonzero elements right after the allocation in certain circumstances). An attacker could use this flaw to obtain potentially sensitive information. This flaw may also lead to various functionality problems that do not have security impacts.
References (including the reproducer):
[1] http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7196857
[2] http://www.openwall.com/lists/oss-security/2012/09/12/4
Discussion:
This is a serious bug, not just an "information disclosure flaw".
The JLS says that all variables are initialized to 0/null, and code ofte
Bugzilla
CVE-2012-4416 OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606)
bugzilla·2012-09-11·CVSS 6.4
CVE-2012-4416 [MEDIUM] CVE-2012-4416 OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606)
CVE-2012-4416 OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606)
An information disclosure flaw was found in the way Java Virtual Machine (JVM) implementation of Oracle Java SE 7 used to initialize integer arrays (they have had nonzero elements right after the allocation in certain circumstances). An attacker could use this flaw to obtain potentially sensitive information.
References (including the reproducer):
[1] http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7196857
Discussion:
Local copy of the reproducer, workaround and further issue occurrence details
from [1]):
This bug can be reproduced always.
---------- BEGIN SOURCE ----------
public class JvmBug {
public static void main(String[] args) {
int[] a;
int n = 0;
for (int i = 0; i The same problem present
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-10/msg00023.htmlhttp://marc.info/?l=bugtraq&m=135542848327757&w=2http://marc.info/?l=bugtraq&m=135758563611658&w=2http://rhn.redhat.com/errata/RHSA-2012-1385.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1386.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1391.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1392.htmlhttp://secunia.com/advisories/51028http://secunia.com/advisories/51029http://secunia.com/advisories/51141http://secunia.com/advisories/51166http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-023/index.htmlhttp://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.htmlhttp://www.securityfocus.com/bid/55501http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdfhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16623http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-10/msg00023.htmlhttp://marc.info/?l=bugtraq&m=135542848327757&w=2http://marc.info/?l=bugtraq&m=135758563611658&w=2http://rhn.redhat.com/errata/RHSA-2012-1385.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1386.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1391.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1392.htmlhttp://secunia.com/advisories/51028http://secunia.com/advisories/51029http://secunia.com/advisories/51141http://secunia.com/advisories/51166http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-023/index.htmlhttp://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.htmlhttp://www.securityfocus.com/bid/55501http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdfhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16623
2012-10-16
Published