CVE-2012-5088
CriticalPublic exploitOpenJDK: MethodHandle insufficient access control checks (Libraries, 7196190)
Published Oct 16, 2012 · Updated Aug 6, 2024
Key Facts
Patch immediately- CVE-2012-5088 is a critical-severity vulnerability (CVSS 10.0 v2) affecting Jdk (Oracle), Jre (Oracle), openjdk-11-openj9 (chainguard) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 79% probability of exploitation in the next 30 days.
- Fixed versions are available, including java 1.7.0-oracle-1:1.7.0.9-1jpp.3.el6_3, java-1_7_0-ibm 1.7.0_sr6.0-0.7.1, java-1_7_0-ibm-alsa 1.7.0_sr6.0-0.7.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS (30-day exploit likelihood)
79%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2012-5088 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
Affected Products
53 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| JdkOracle | 1.7.0, 1.7.0-update1, 1.7.0-update2, 1.7.0-update3, 1.7.0-update4, 1.7.0-update5, 1.7.0-update6 | 1.7.0 |
| JreOracle | 1.7.0, 1.7.0-update1, 1.7.0-update2, 1.7.0-update3, 1.7.0-update4, 1.7.0-update5, 1.7.0-update6 | 1.7.0 |
| openjdk-11-openj9chainguard | See advisory | 0.53.0-r0 |
| openjdk-17-openj9chainguard | See advisory | 0.53.0-r0 |
| openjdk-21-openj9chainguard | See advisory | 0.48.0-r2 |
Patched Releases
java
1.7.0-oracle-1:1.7.0.9-1jpp.3.el6_3
java-1_7_0-ibm
1.7.0_sr6.0-0.7.1
java-1_7_0-ibm-alsa
1.7.0_sr6.0-0.7.1
java-1_7_0-ibm-devel
1.7.0_sr7.0-0.5.1
java-1_7_0-ibm-jdbc
1.7.0_sr6.0-0.7.1
java-1_7_0-ibm-plugin
1.7.0_sr6.0-0.7.1
java-1_7_0-openjdk
1.7.0.121-1.1
java-1_7_0-openjdk-accessibility
1.7.0.121-1.1
java-1_7_0-openjdk-bootstrap
1.7.0.121-1.1
java-1_7_0-openjdk-bootstrap-devel
1.7.0.121-1.1
java-1_7_0-openjdk-bootstrap-headless
1.7.0.121-1.1
java-1_7_0-openjdk-demo
1.7.0.121-1.1
java-1_7_0-openjdk-devel
1.7.0.121-1.1
java-1_7_0-openjdk-headless
1.7.0.121-1.1
java-1_7_0-openjdk-javadoc
1.7.0.121-1.1
java-1_7_0-openjdk-src
1.7.0.121-1.1
java-1.7.0-openjdk
1:1.7.0.9-2.3.3.0.1.el6_3.1
java-1.7.0-openjdk-demo
1:1.7.0.9-2.3.3.0.1.el6_3.1
java-1.7.0-openjdk-devel
1:1.7.0.9-2.3.3.0.1.el6_3.1
java-1.7.0-openjdk-javadoc
1:1.7.0.9-2.3.3.0.1.el6_3.1
java-1.7.0-openjdk-src
1:1.7.0.9-2.3.3.0.1.el6_3.1
openjdk-11-openj9
0.53.0-r0
openjdk-17-openj9
0.53.0-r0
openjdk-21-openj9
0.48.0-r2
openjdk-25-openj9
0.59.0-r1
Timeline
Publicly disclosed
Oct 16, 2012
Last updated
Aug 6, 2024
References
- advisoryRHSA-2012:1386
- advisoryRHSA-2012:1391
- advisoryRHSA-2012:1467
- patchhttp://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html
- exploitMSF java_jre17_method_handle.rb
FAQ
Common Questions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
Affected: Jdk (Oracle) versions 1.7.0, 1.7.0-update1, 1.7.0-update2, 1.7.0-update3, 1.7.0-update4, 1.7.0-update5, 1.7.0-update6; Jre (Oracle) versions 1.7.0, 1.7.0-update1, 1.7.0-update2, 1.7.0-update3, 1.7.0-update4, 1.7.0-update5, 1.7.0-update6; openjdk-11-openj9 (chainguard), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including java 1.7.0-oracle-1:1.7.0.9-1jpp.3.el6_3, java-1_7_0-ibm 1.7.0_sr6.0-0.7.1, java-1_7_0-ibm-alsa 1.7.0_sr6.0-0.7.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2012-5088 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo