sun jdk CVE-2012-4681 vulnerability in Sun and Other Products
Published on August 28, 2012

product logo product logo product logo
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Vendor Advisory NVD

Known Exploited Vulnerability

This Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.

The following remediation steps are recommended / required by March 24, 2022: Apply updates per vendor instructions.

Vulnerability Analysis


Products Associated with CVE-2012-4681

You can be notified by stack.watch whenever vulnerabilities like CVE-2012-4681 are published in these products:

Sun Jdk
 
Sun Jre
 
Oracle Java Runtime Environment (JRE)
 
Oracle Java Development Kit (JDK)
 
Red Hat Enterprise Linux Desktop
 
Red Hat Enterprise Linux Server
 
Red Hat Enterprise Linux Workstation
 
Red Hat Enterprise Linux Eus
 

What versions are vulnerable to CVE-2012-4681?