CVE-2012-5067
MediumPublic exploitJDK: unspecified vulnerability (Deployment)
Published Oct 16, 2012 · Updated Aug 6, 2024
Key Facts
Patch immediately- CVE-2012-5067 is a medium-severity vulnerability (CVSS 5.0 v2) affecting Jdk (Oracle), Jre (Oracle), openjdk-11-openj9 (chainguard) and 11 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 64% probability of exploitation in the next 30 days.
- Fixed versions are available, including java 1.7.0-oracle-1:1.7.0.9-1jpp.3.el6_3, java-1_7_0-ibm 1.7.0_sr6.0-0.7.1, java-1_7_0-ibm-alsa 1.7.0_sr6.0-0.7.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS (30-day exploit likelihood)
64%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2012-5067 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Deployment.
Affected Products
38 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| JdkOracle | 1.7.0, 1.7.0-update1, 1.7.0-update2, 1.7.0-update3, 1.7.0-update4, 1.7.0-update5, 1.7.0-update6 | 1.7.0 |
| JreOracle | 1.7.0, 1.7.0-update1, 1.7.0-update2, 1.7.0-update3, 1.7.0-update4, 1.7.0-update5, 1.7.0-update6 | 1.7.0 |
| openjdk-11-openj9chainguard | See advisory | 0.53.0-r0 |
| openjdk-17-openj9chainguard | See advisory | 0.53.0-r0 |
| openjdk-21-openj9chainguard | See advisory | 0.48.0-r2 |
Patched Releases
java
1.7.0-oracle-1:1.7.0.9-1jpp.3.el6_3
java-1_7_0-ibm
1.7.0_sr6.0-0.7.1
java-1_7_0-ibm-alsa
1.7.0_sr6.0-0.7.1
java-1_7_0-ibm-devel
1.7.0_sr7.0-0.5.1
java-1_7_0-ibm-jdbc
1.7.0_sr6.0-0.7.1
java-1_7_0-ibm-plugin
1.7.0_sr6.0-0.7.1
openjdk-11-openj9
0.53.0-r0
openjdk-17-openj9
0.53.0-r0
openjdk-21-openj9
0.48.0-r2
openjdk-25-openj9
0.59.0-r1
openjdk-26-openj9
0.59.0-r1
openjdk-8-openj9
0.53.0-r1
Jdk
1.7.0
Jre
1.7.0
Timeline
Publicly disclosed
Oct 16, 2012
Last updated
Aug 6, 2024
References
- advisoryRHSA-2012:1391
- advisoryRHSA-2012:1467
- patchhttp://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html
- exploitMSF java_jre17_jaxws.rb
- exploitExploitDB-22657
FAQ
Common Questions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Deployment.
Affected: Jdk (Oracle) versions 1.7.0, 1.7.0-update1, 1.7.0-update2, 1.7.0-update3, 1.7.0-update4, 1.7.0-update5, 1.7.0-update6; Jre (Oracle) versions 1.7.0, 1.7.0-update1, 1.7.0-update2, 1.7.0-update3, 1.7.0-update4, 1.7.0-update5, 1.7.0-update6; openjdk-11-openj9 (chainguard), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including java 1.7.0-oracle-1:1.7.0.9-1jpp.3.el6_3, java-1_7_0-ibm 1.7.0_sr6.0-0.7.1, java-1_7_0-ibm-alsa 1.7.0_sr6.0-0.7.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2012-5067 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo