CVE-2012-4420
published 2019-12-26CVE-2012-4420: An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
4.51%
90.5th percentile
An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| java-1.7.0-openjdk | java-1.7.0-openjdk | — | — |
| oracle | jdk | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
java-1.7.0-openjdk: JVM heap memory disclosure
vendor_redhat·2012-09-07·CVSS 6.4
CVE-2012-4420 [MEDIUM] java-1.7.0-openjdk: JVM heap memory disclosure
java-1.7.0-openjdk: JVM heap memory disclosure
An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.
Statement: This flaw was found to be a duplicate of CVE-2012-4416. Please see https://access.redhat.com/security/cve/CVE-2012-4416 for information about affected products and security errata.
Package: java-1.4.2-ibm (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.4.2-ibm-sap (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.5.0-ibm (Red Hat Enterprise Linux 5)
GHSA
GHSA-qmhj-qfmf-95g9: An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly in
ghsa_unreviewed·2022-04-23
CVE-2012-4420 [HIGH] CWE-200 GHSA-qmhj-qfmf-95g9: An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly in
An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-4420 java-1.7.0-openjdk: JVM heap memory disclosure
bugzilla·2012-09-12·CVSS 6.4
CVE-2012-4420 [MEDIUM] CVE-2012-4420 java-1.7.0-openjdk: JVM heap memory disclosure
CVE-2012-4420 java-1.7.0-openjdk: JVM heap memory disclosure
An information disclosure flaw was found in the way Java Virtual Machine (JVM) implemenation of Java SE 7 as provided by OpenJDK 7, used to initialize integer arrays (they have had nonzero elements right after the allocation in certain circumstances). An attacker could use this flaw to obtain potentially sensitive information. This flaw may also lead to various functionality problems that do not have security impacts.
References (including the reproducer):
[1] http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7196857
[2] http://www.openwall.com/lists/oss-security/2012/09/12/4
Discussion:
This is a serious bug, not just an "information disclosure flaw".
The JLS says that all variables are initialized to 0/null, and code ofte
Bugzilla
CVE-2012-4416 OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606)
bugzilla·2012-09-11·CVSS 6.4
CVE-2012-4416 [MEDIUM] CVE-2012-4416 OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606)
CVE-2012-4416 OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606)
An information disclosure flaw was found in the way Java Virtual Machine (JVM) implementation of Oracle Java SE 7 used to initialize integer arrays (they have had nonzero elements right after the allocation in certain circumstances). An attacker could use this flaw to obtain potentially sensitive information.
References (including the reproducer):
[1] http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7196857
Discussion:
Local copy of the reproducer, workaround and further issue occurrence details
from [1]):
This bug can be reproduced always.
---------- BEGIN SOURCE ----------
public class JvmBug {
public static void main(String[] args) {
int[] a;
int n = 0;
for (int i = 0; i The same problem present
http://www.openwall.com/lists/oss-security/2012/09/13/3http://www.securityfocus.com/bid/55538https://access.redhat.com/security/cve/cve-2012-4420https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7196857https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4420https://exchange.xforce.ibmcloud.com/vulnerabilities/78693https://www.openwall.com/lists/oss-security/2012/09/12/4http://www.openwall.com/lists/oss-security/2012/09/13/3http://www.securityfocus.com/bid/55538https://access.redhat.com/security/cve/cve-2012-4420https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7196857https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4420https://exchange.xforce.ibmcloud.com/vulnerabilities/78693https://www.openwall.com/lists/oss-security/2012/09/12/4
2019-12-26
Published