Java SE CPU Feb 2012

Released February 2012 · Oracle's advisory ↗ · ← Critical Patch Update, January 2012 · Critical Patch Update, April 2012 →

14 CVEs in this release, one square each

By status

5No exploit published 9Outside Waratek scope 1Exploited, marked by the ring

No exploit published. For 5 of them, Oracle's security advisory is the source of public detail.

Look up CVE IDs Status Exploitation Severity

Reset

Overview 14 matches · 5 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5

14matches 5in Waratek scope35.7% 0protected0.0% 1exploited7.1% 1CISA KEV7.1% 3public PoC21.4% 3EPSS ≥ 0.521.4%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 5 35.7% Outside Waratek scope 9 64.3% Not applicable 0 0.0% Withdrawn CVE 0 0.0%

Critical 1 7.1% High 8 57.1% Medium 5 35.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 7.1% Working exploit published 2 14.3% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 11 78.6%

split by StatusSeverityProtectionExploit maturity peak 12 / month

Dec 111 Outside Waratek scope1 Medium1 not blocked1 Working exploit published1 Jan 120 Feb 1212 No exploit published5 Outside Waratek scope7 High8 Medium4 not blocked12 Working exploit published1 No public exploit11 Mar 120 Apr 120 May 120 Jun 121 Outside Waratek scope1 Critical1 not blocked1 Exploited1

Dec 11Jan 12Feb 12Mar 12Apr 12May 12Jun 12

14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2012-0507	Critical	2012-06-07	Outside Waratek scope	Exploited	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
CVE-2012-0508	High	2012-02-15	Outside Waratek scope	No public exploit	Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX, 1.3.0 and earlier, and 1.2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2012-0506	Medium	2012-02-15	Outside Waratek scope	No public exploit	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to CORBA.
CVE-2012-0505	High	2012-02-15	Outside Waratek scope	No public exploit	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.
CVE-2012-0504	High	2012-02-15	Outside Waratek scope	No public exploit	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, and 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install and the Java Update mechanism.
CVE-2012-0503	High	2012-02-15	Outside Waratek scope	No public exploit	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to I18n.
CVE-2012-0502	Medium	2012-02-15	Outside Waratek scope	No public exploit	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and availability, related to AWT.
CVE-2012-0501	Medium	2012-02-15	No exploit published	No public exploit	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect availability via unknown vectors.
CVE-2012-0500	High	2012-02-15	Outside Waratek scope	Working exploit published	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
CVE-2012-0499	High	2012-02-15	No exploit published	No public exploit	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier; and JavaFX 2.0.2 and earlier; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVE-2012-0498	High	2012-02-15	No exploit published	No public exploit	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVE-2012-0497	High	2012-02-15	No exploit published	No public exploit	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, and 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVE-2011-3563	Medium	2012-02-15	No exploit published	No public exploit	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote attackers to affect confidentiality and availability via unknown vectors related to Sound.
CVE-2011-5035	Medium	2011-12-30	Outside Waratek scope	Working exploit published	Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2012-0507

Critical

2012-06-07

Outside Waratek scope

Exploited

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

CVE-2012-0508

High

2012-02-15

Outside Waratek scope

No public exploit

Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX, 1.3.0 and earlier, and 1.2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVE-2012-0506

Medium

2012-02-15

Outside Waratek scope

No public exploit

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to CORBA.

CVE-2012-0505

High

2012-02-15

Outside Waratek scope

No public exploit

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.

CVE-2012-0504

High

2012-02-15

Outside Waratek scope

No public exploit

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, and 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install and the Java Update mechanism.

CVE-2012-0503

High

2012-02-15

Outside Waratek scope

No public exploit

CVE-2012-0502

Medium

2012-02-15

Outside Waratek scope

No public exploit

CVE-2012-0501

Medium

2012-02-15

No exploit published

No public exploit

CVE-2012-0500

High

2012-02-15

Outside Waratek scope

Working exploit published

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVE-2012-0499

High

2012-02-15

No exploit published

No public exploit

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier; and JavaFX 2.0.2 and earlier; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVE-2012-0498

High

2012-02-15

No exploit published

No public exploit

CVE-2012-0497

High

2012-02-15

No exploit published

No public exploit

CVE-2011-3563

Medium

2012-02-15

No exploit published

No public exploit

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote attackers to affect confidentiality and availability via unknown vectors related to Sound.

CVE-2011-5035

Medium

2011-12-30

Outside Waratek scope

Working exploit published

Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.