{"id":"CVE-2012-5080","description":"Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2012-5078.","cvssScore":7.6,"cvssVersion":"2.0","cvssVector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","cvssMetrics":[{"version":"2.0","score":7.6,"vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"resolved":"OUT-OF-SCOPE","published":"2012-10-16","lastModified":"2026-06-16","affectedProducts":[{"vendor":"oracle","product":"javafx","versionEnd":"\u003c=2.2"},{"vendor":"oracle","product":"javafx","version":"1.2"},{"vendor":"oracle","product":"javafx","version":"1.2.2"},{"vendor":"oracle","product":"javafx","version":"1.2.3"},{"vendor":"oracle","product":"javafx","version":"1.3.0"},{"vendor":"oracle","product":"javafx","version":"1.3.1"},{"vendor":"oracle","product":"javafx","version":"2.0"},{"vendor":"oracle","product":"javafx","version":"2.0.2"},{"vendor":"oracle","product":"javafx","version":"2.0.3"},{"vendor":"oracle","product":"javafx","version":"2.1"},{"vendor":"suse","product":"linux enterprise desktop","version":"11","update":"sp2"}],"totalAffectedProducts":2,"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html","source":"secalert_us@oracle.com","tags":["Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html","source":"secalert_us@oracle.com","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/56068","source":"secalert_us@oracle.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79439","source":"secalert_us@oracle.com"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16221","source":"secalert_us@oracle.com"}],"reasoning":{"decidingSource":"oracle-component","decidingReason":"This CVE affects Oracle's JavaFX component, which Waratek RASP does not instrument. Oracle does not assign JavaFX its own CPE product, so this is detected from the CVE description rather than CPE data.","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"withheld","detail":"Historical environment classification superseded by the dedicated javafx component rule"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"matched","status":"OUT-OF-SCOPE","detail":"Description names the \"JavaFX\" component (\"component: JavaFX\")","decisive":true}]},"oracleAdvisories":[{"advisory":"Java SE CPU Oct 2012","releaseType":"CPU","quarter":"2012-Q4","url":"https://www.oracle.com/security-alerts/javacpuoct2012.html","products":[{"product":"Oracle Java SE","component":"JavaFX","affectedVersions":"JavaFX 2.2 and before"}]}],"assessment":{"record":{"state":"active"},"protection":{"level":"none"},"action":{"state":"not-needed","type":"none"},"review":{"state":"automated","basis":"inferred"}},"h2Comments":"## Manual Classification Context\n\n\n**Labels:** -, MULTIPLE, NO AUTH REMOTE EXPLOIT, SEE NOTE 2\n\n**Products:** ORACLE JAVA SE, JAVAFX","signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.04216,"percentile":0.90443},"ssvc":{"available":false}}