CVE-2012-0507: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: yes — in CISA KEV since 2022-03-03
EPSS: 98.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-07 · updated 2026-08-14
Weakness: CWE-843

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

Affected products

Debian Linux: 6.0, 7.0
Oracle Java SE: 1.6.0-update22, 1.6.0-update23, 1.6.0-update24, 1.6.0-update25, 1.6.0-update26, 1.6.0-update27 (+5)
Sun Jre: 1.5.0, 1.5.0-update1, 1.5.0-update10, 1.5.0-update11, 1.5.0-update12, 1.5.0-update13 (+46)
SUSE Linux Enterprise Server 15 SP1: 10-sp4
SUSE Linux Enterprise Java: 10-sp4, 11-sp1
SUSE Linux Enterprise Server: 10-sp4, 11-sp1, 11-sp2
SUSE Linux Enterprise Software Development Kit: 11-sp1, 11-sp2

References

Get alerted when CVE-2012-0507 or the next vulnerability affects your stack