Exploited· due 2022-03-249.8criticalCriticalused in ransomware

CVE-2012-0507

Sun Jre

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

Exploitation status

CISA has confirmed this is being exploited in the wild. That is an observation of real attacks, not a prediction.
It is known to have been used in ransomware campaigns.
US federal civilian agencies are required to remediate it by 2022-03-24. That deadline does not bind private companies, but it is a reasonable benchmark for how urgently CISA views it.
A vendor advisory or patch reference has been published.

Required action

Apply updates per vendor instructions.

CISA’s wording, unedited.

What the metrics mean

It is reachable over a network, without needing local access.
For an attacker who can reach it, no special conditions are needed to exploit it.
To exploit it, no account is needed.
Beyond that, no action by a user is required.

Scoring

CVSS: 9.8 (v3.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-843
Assigned by: secalert_us@oracle.com

Dates

Published: 2012-06-07
Last modified: 2026-08-14
Added to KEV: 2022-03-03
Remediation due: 2022-03-24
Sources: CISA KEV, NVD

Affected products

Sun Jre1.5.0, 1.6.0
Oracle Jre1.6.0, 1.7.0
Debian Debian Linux6.0, 7.0
Suse Linux Enterprise Desktop10
Suse Linux Enterprise Java10, 11
Suse Linux Enterprise Server10, 11
Suse Linux Enterprise Software Development Kit11

As listed in the NVD configuration data. Not a statement about your estate.