CVE-2012-4681

Advisory lineage Upstream: 0 Downstream: 4
Analyzed
Published: 28 Aug 2012, 00:00
Last modified:22 Oct 2025, 00:05

Vulnerability Summary

Overall Risk (default)
critical
90/100
CVSS Score
10 HIGH
v2.0 (nvd)
EPSS Score
94.14% CRITICAL
94% probability +0.19%
KEV
Listed
CISA
1 listing
Ransomware
Known Use
Public exploits
4 found
Dark Web
Not detected

Timeline

28 Aug 2012, 00:00
Published
Vulnerability first disclosed
03 Mar 2022, 00:00
Added to CISA KEV
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
24 Mar 2022, 00:00
CISA Remediation Due
Apply updates per vendor instructions.
22 Oct 2025, 00:05
Last Modified
Vulnerability information updated

Description

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 10AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 94.14%• Percentile: 100%

Techniques & Countermeasures

  • CWE-284•Improper Access Control

    The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected Systems

  • oracle•jdk

    1.6.0 | 1.6.0:update1 | 1.6.0:update10 | 1.6.0:update11 | 1.6.0:update12 | 1.6.0:update13 | 1.6.0:update14 | 1.6.0:update15 | 1.6.0:update16 | 1.6.0:update17 | 1.6.0:update18 | 1.6.0:update19 | 1.6.0:update2 | 1.6.0:update20 | 1.6.0:update21 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update3 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.6.0:update33 | 1.6.0:update34 | 1.6.0:update4 | 1.6.0:update5 | 1.6.0:update6 | 1.6.0:update7 | 1.6.0:update8 | 1.6.0:update9 | 1.7.0 | 1.7.0:update1 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6

  • oracle•jre

    1.6.0 | 1.6.0:update1 | 1.6.0:update10 | 1.6.0:update11 | 1.6.0:update12 | 1.6.0:update13 | 1.6.0:update14 | 1.6.0:update15 | 1.6.0:update16 | 1.6.0:update17 | 1.6.0:update18 | 1.6.0:update19 | 1.6.0:update2 | 1.6.0:update20 | 1.6.0:update21 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update3 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.6.0:update33 | 1.6.0:update34 | 1.6.0:update4 | 1.6.0:update5 | 1.6.0:update6 | 1.6.0:update7 | 1.6.0:update9 | 1.7.0 | 1.7.0:update1 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6

  • redhat•enterprise_linux_desktop

    6.0

  • redhat•enterprise_linux_eus

    6.3

  • redhat•enterprise_linux_server

    6.0

  • redhat•enterprise_linux_workstation

    6.0

References (14)