CVE-2012-5077
published 2012-10-16CVE-2012-5077: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and…
PriorityP420low2.6CVSS 2.0
AVNACHAuNCPINAN
EPSS
3.14%
86.4th percentile
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Security.
Affected
90 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | jdk | <= 1.7.0 | — |
| oracle | jdk | <= 1.6.0 | — |
| oracle | jdk | <= 1.5.0 | — |
| oracle | jdk | <= 1.4.2_38 | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | <= 1.7.0 | — |
| oracle | jre | <= 1.6.0 | — |
| oracle | jre | <= 1.5.0 | — |
| oracle | jre | <= 1.4.2_38 | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
vendor_ubuntu10.0CRITICAL
vendor_redhat2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK vulnerabilities
vendor_ubuntu·2012-10-26·CVSS 10.0
CVE-2012-1531 [CRITICAL] OpenJDK vulnerabilities
Title: OpenJDK vulnerabilities
Summary: Several security issues were fixed in OpenJDK.
Several information disclosure vulnerabilities were discovered in the
OpenJDK JRE. (CVE-2012-3216, CVE-2012-5069, CVE-2012-5072, CVE-2012-5075,
CVE-2012-5077, CVE-2012-5085)
Vulnerabilities were discovered in the OpenJDK JRE related to information
disclosure and data integrity. (CVE-2012-4416, CVE-2012-5071)
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to cause a denial of service. (CVE-2012-1531, CVE-2012-1532, CVE-2012-1533,
CVE-2012-3143, CVE-2012-3159, CVE-2012-5068, CVE-2012-5083, CVE-2012-5084,
CVE-2012-5086, CVE-2012-5089)
Information disclosure vulnerabilities were discovered in the OpenJDK JR
Red Hat
OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656)
vendor_redhat·2012-10-16·CVSS 2.6
CVE-2012-5077 [LOW] OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656)
OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Security.
Package: java-1.7.0-ibm (Red Hat Enterprise Linux 5) - Affected
Package: java-1.7.0-openjdk (Red Hat Enterprise Linux 5) - Affected
Package: java-1.7.0-oracle (Red Hat Enterprise Linux 5) - Affected
GHSA
GHSA-rm29-f2rr-x57m: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5
ghsa_unreviewed·2022-05-14
CVE-2012-5077 [LOW] GHSA-rm29-f2rr-x57m: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Security.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-5077 OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656)
bugzilla·2012-10-11·CVSS 2.6
CVE-2012-5077 [LOW] CVE-2012-5077 OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656)
CVE-2012-5077 OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656)
It was discovered that the SecureRandom class did not properly protect
against the creation of multiple seeders. An untrusted Java application or
applet could possibly use this flaw to disclose sensitive information.
Discussion:
Fixed now in Oracle JDK 7u9 and 6u37.
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html
---
Fix included in IcedTea6 versions 1.10.10 and 1.11.5:
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-October/020556.html
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/d9564350faa6/patches/security/20121016/7167656.patch
---
This issue has been addressed in following products:
Red Hat Enterprise Lin
Bugzilla
CVE-2010-5077 quake3: DDoS via getstatus and rcon requests
bugzilla·2012-03-26·CVSS 7.8
CVE-2010-5077 [HIGH] CVE-2010-5077 quake3: DDoS via getstatus and rcon requests
CVE-2010-5077 quake3: DDoS via getstatus and rcon requests
A distributed denial of service flaw was found in the way Quake3 Arena / OpenArena servers used to handle 'getstatus' and 'rcon' (remote command) connectionless requests. A remote attacker could use this flaw to perform distributed denial of service attack against the target server IP gameserver by spoofing certain packets.
References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665656
[2] http://openarena.ws/board/index.php?topic=4391.0
[3] http://www.ioquake.org/forums/viewtopic.php?f=12&t=1694
[4] http://www.urbanterror.info/forums/topic/27825-drdos/
[5] http://lists.ioquake.org/pipermail/ioquake3-ioquake.org/2012-January/004778.html
Relevant upstream patch:
[6] http://icculus.org/pipermail/quake3-commits/2010-Januar
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-10/msg00023.htmlhttp://marc.info/?l=bugtraq&m=135542848327757&w=2http://marc.info/?l=bugtraq&m=135758563611658&w=2http://rhn.redhat.com/errata/RHSA-2012-1385.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1386.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1391.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1392.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1467.htmlhttp://secunia.com/advisories/51028http://secunia.com/advisories/51029http://secunia.com/advisories/51141http://secunia.com/advisories/51166http://secunia.com/advisories/51326http://secunia.com/advisories/51390http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-023/index.htmlhttp://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.htmlhttp://www.securityfocus.com/bid/56058http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdfhttps://exchange.xforce.ibmcloud.com/vulnerabilities/79437https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16585http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-10/msg00023.htmlhttp://marc.info/?l=bugtraq&m=135542848327757&w=2http://marc.info/?l=bugtraq&m=135758563611658&w=2http://rhn.redhat.com/errata/RHSA-2012-1385.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1386.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1391.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1392.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1467.htmlhttp://secunia.com/advisories/51028http://secunia.com/advisories/51029http://secunia.com/advisories/51141http://secunia.com/advisories/51166http://secunia.com/advisories/51326http://secunia.com/advisories/51390http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-023/index.htmlhttp://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.htmlhttp://www.securityfocus.com/bid/56058http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdfhttps://exchange.xforce.ibmcloud.com/vulnerabilities/79437https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16585
2012-10-16
Published