CVE-2012-1723: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: yes — in CISA KEV since 2022-03-03
EPSS: 93.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-16 · updated 2026-08-06
Weakness: CWE-284

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

Affected products

Oracle Java SE: through 1.4.2_37; 1.5.0, 1.5.0-update1, 1.5.0-update10, 1.5.0-update11, 1.5.0-update12, 1.5.0-update13 (+57)
Oracle Java SE: through 1.4.2_37; 1.5.0, 1.5.0-update1, 1.5.0-update10, 1.5.0-update11, 1.5.0-update12, 1.5.0-update13 (+55)
RedHat Enterprise Linux Desktop: 5.0, 6.0
RedHat Enterprise Linux Eus: 6.2
RedHat Enterprise Linux Server: 5.0, 6.0
RedHat Enterprise Linux Server Aus: 6.2
RedHat Enterprise Linux Workstation: 5.0, 6.0
IcedTea6: before 1.10.8; from 1.11.0 before 1.11.3 — fixed in 1.10.8, 1.11.3

How to fix

Upgrade to a fixed version: IcedTea6 1.10.8, 1.11.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2012-1723 or the next vulnerability affects your stack