CVE-2012-1723 Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution
Remote attackers can compromise confidentiality, integrity, and availability in Oracle Java SE via unspecified Hotspot vectors.
- Exploited in the wild
- Since 3 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-1723?
CVE-2012-1723 is a critical vulnerability in Oracle Jdk, published on 16 Jun 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Weakness: CWE-284
Which versions are affected by CVE-2012-1723?
It affects 8 products.
Products include Oracle Jdk, Oracle Jre, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus and 2 more.
How do I fix CVE-2012-1723?
Upgrade to a fixed version. US federal agencies must fix it by 24 Mar 2022.
Is CVE-2012-1723 being exploited?
Yes. Attackers have exploited CVE-2012-1723 in the wild since at least 3 Mar 2022, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in Oracle Jdk
Sources
Also known as GHSA-ch9c-pq9h-jrr9, MINI-35rg-ghrf-6q5w, MINI-37pm-mjjm-x52q, MINI-447c-jw5v-gp8q, MINI-64pm-48xv-mj7m, MINI-fqm7-9f35-7vgr and 2 more.