CVE-2012-0547 Security feature bypass in n/a
A defense-in-depth issue in Java AWT internals can aggravate other vulnerabilities, requiring an upgrade to mitigate potential exploitation chains.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2012-0547?
CVE-2012-0547 is a vulnerability in Oracle Jdk, published on 30 Aug 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and "a security-in-depth issue that is not directly exploitable but which can be used to aggravate security vulnerabilities that can be directly exploited." NOTE: this identifier was assigned by the Oracle CNA, but CVE is not intended to cover defense-in-depth issues that are only exposed by the presence of other vulnerabilities. NOTE: Oracle has not commented on claims from a downstream vendor that this issue is related to "toolkit internals references."
Which versions are affected by CVE-2012-0547?
It affects 4 products.
Products include Oracle Jdk, Oracle Jre, Sun Jdk, Sun Jre.
How do I fix CVE-2012-0547?
Upgrade to a fixed version.
Is CVE-2012-0547 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-0547 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Oracle Jdk
Sources
Also known as GHSA-mpj2-6qj6-74jr.