WaratekVRT Sign in

CVE-2012-1723 Oracle JDK

Affected softwareOracle JDK
Affected versions7 Update 4 and before, 6 Update 32 and before, 5 Update 35 and before, 1.4.2_37 and before
Severity9.8 Critical CVSS 3.1 2 scores
Fixed inJava SE CPU Jun 2012
WeaknessImproper access control (CWE-284)
Published16 Jun 2012
Updated29 Sep 2026

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-03 · remediation due 2022-03-24 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 20 citations · 1 exploit · earliest 2013-03-14.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 3 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit; first seen 2012-07-11.
  • EPSS 94% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2012-1723 in VulnCheck (free account), which lists 15 more citations not shown here.

EvidenceSourceDetailDate
Reported exploitation blog.malwarebytes.com /threat-analysis/2013/03/new-exploit-kit-ransomware-and-av-evasion 2013-03-14
Reported exploitation cybersecurity.att.com /blogs/labs-research/new-sykipot-developments 2013-03-21
Reported exploitation blogs.cisco.com /security/watering-hole-attacks-target-energy-sector 2013-09-13
Reported exploitation paper.seebug.org /papers/APT/APT_CyberCriminal_Campagin/2013/hidden_lynx.pdf 2013-09-17
Reported exploitation securelist.com /the-icefog-apt-a-tale-of-cloak-and-three-daggers/57331 2013-09-25
Exploit reference VulnCheck XDB 83ff19c4dc8c Exploit type: client-side 2017-02-20

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Proof of concept exploit for CVE-2012-1723 2017-02-20
Exploit-DB Java Applet - Field Bytecode Verifier Cache Remote Code Execution (Metasploit) 2012-07-11
Metasploit Java Applet Field Bytecode Verifier Cache Remote Code Execution (excellent rank)

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to Outside Waratek scope.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Java applet / Web Start sandbox escape: needs untrusted code running under the Java sandbox, which a server running trusted code never does.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary published
CVSS 2.0 10.0 none AV:N/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Java SE CPU Jun 2012 ↗ CPU 2012-Q2 Oracle Java SE / Java Runtime Environment (7 Update 4 and before, 6 Update 32 and before, 5 Update 35 and before, 1.4.2_37 and before)
Oracle's note: Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Java SE Java Runtime Environment 7 Update 4 and before, 6 Update 32 and before, 5 Update 35 and before, 1.4.2_37 and before

Products and versions

8 products, 136 version entries
SourceVendorProductSchemeAffected versions
nvd oracle jdk javase ≤ 4.2.37.0 · 1.5.0 · 1.5.0:update1 · 1.5.0:update2 · 1.5.0:update3 · 1.5.0:update10 · 1.5.0:update11 · 1.5.0:update12 · 1.5.0:update13 · 1.5.0:update14 · 1.5.0:update15 · 1.5.0:update16 · 1.5.0:update17 · 1.5.0:update18 · 1.5.0:update19 · 1.5.0:update20 · 1.5.0:update21 · 1.5.0:update22 · 1.5.0:update23 · 1.5.0:update24 · 1.5.0:update25 · 1.5.0:update26 · 1.5.0:update27 · 1.5.0:update28 · 1.5.0:update29 · 1.5.0:update30 · 1.5.0:update31 · 1.5.0:update32 · 1.5.0:update33 · 1.5.0:update34 · 1.5.0:update35 · 1.6.0 · 1.6.0:update1 · 1.6.0:update2 · 1.6.0:update3 · 1.6.0:update10 · 1.6.0:update11 · 1.6.0:update12 · 1.6.0:update13 · 1.6.0:update14 · 1.6.0:update15 · 1.6.0:update16 · 1.6.0:update17 · 1.6.0:update18 · 1.6.0:update19 · 1.6.0:update20 · 1.6.0:update21 · 1.6.0:update22 · 1.6.0:update23 · 1.6.0:update24 · 1.6.0:update25 · 1.6.0:update26 · 1.6.0:update27 · 1.6.0:update29 · 1.6.0:update30 · 1.6.0:update31 · 1.6.0:update32 · 1.6.0:update32_b31 · 1.6.0:update32_b32 · 1.7.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4
nvd oracle jre javase ≤ 4.2.37.0 · 1.5.0 · 1.5.0:update1 · 1.5.0:update2 · 1.5.0:update3 · 1.5.0:update10 · 1.5.0:update11 · 1.5.0:update12 · 1.5.0:update13 · 1.5.0:update14 · 1.5.0:update15 · 1.5.0:update16 · 1.5.0:update17 · 1.5.0:update18 · 1.5.0:update19 · 1.5.0:update20 · 1.5.0:update21 · 1.5.0:update22 · 1.5.0:update23 · 1.5.0:update24 · 1.5.0:update25 · 1.5.0:update26 · 1.5.0:update27 · 1.5.0:update28 · 1.5.0:update29 · 1.5.0:update30 · 1.5.0:update31 · 1.5.0:update32 · 1.5.0:update33 · 1.5.0:update34 · 1.5.0:update35 · 1.6.0 · 1.6.0:update1 · 1.6.0:update2 · 1.6.0:update3 · 1.6.0:update10 · 1.6.0:update11 · 1.6.0:update12 · 1.6.0:update13 · 1.6.0:update14 · 1.6.0:update15 · 1.6.0:update16 · 1.6.0:update17 · 1.6.0:update18 · 1.6.0:update19 · 1.6.0:update20 · 1.6.0:update21 · 1.6.0:update22 · 1.6.0:update23 · 1.6.0:update24 · 1.6.0:update25 · 1.6.0:update26 · 1.6.0:update27 · 1.6.0:update29 · 1.6.0:update30 · 1.6.0:update31 · 1.6.0:update32 · 1.7.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4
nvd redhat enterprise linux desktop generic 5.0 · 6.0
nvd redhat enterprise linux eus generic 6.2
nvd redhat enterprise linux server generic 5.0 · 6.0
nvd redhat enterprise linux server aus generic 6.2
nvd redhat enterprise linux workstation generic 5.0 · 6.0
nvd redhat icedtea6 generic ＜ 1.10.8 · ≥ 1.11.0 and ＜ 1.11.3

References

URLTags
https://access.redhat.com/errata/RHSA-2012:0729 ADVISORY, RHSA-2012:0729
https://access.redhat.com/security/cve/CVE-2012-1723 REPORT, RHSA-2012:0729
https://access.redhat.com/errata/RHSA-2012:0730 ADVISORY, RHSA-2012:0730
https://access.redhat.com/errata/RHSA-2012:1009 ADVISORY, RHSA-2012:1009
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-June/019076.html Mailing List
http://marc.info/?l=bugtraq&m=134496371727681&w=2 Mailing List
http://rhn.redhat.com/errata/RHSA-2012-0734.html Third Party Advisory
http://secunia.com/advisories/51080 Broken Link
http://security.gentoo.org/glsa/glsa-201406-32.xml Third Party Advisory
http://www.ibm.com/support/docview.wss?uid=swg21615246 Broken Link

Timeline
Published2012-06-16By the CVE Program.
VulnCheck KEV: earliest evidence2013-03-14Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-03-03Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2026-07-14Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-08-06NVD's own last-modified date for this record.
Last VRT activity2026-09-29Most recent commit touching this CVE's classification, patch or rule file.
Classification created2026-11-13First commit adding this CVE's research note.