What’s Vulnerable › Vulnerabilities

CVE-2012-4820

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-01-11 · updated 2026-06-16

Description

Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to "insecure use of the java.lang.reflect.Method invoke() method."

Affected products

• IBM Java: from 1.4.2 through 1.4.2.13.13; from 5.0.0.0 through 5.0.14.0; from 6.0.0.0 through 6.0.11.0; from 7.0.0.0 through 7.0.2.0
• IBM Lotus Domino: 8.0, 8.0.1, 8.0.2, 8.0.2.1, 8.0.2.2, 8.0.2.3 (+17)
• IBM Lotus Notes: 8.0, 8.0.0, 8.0.1, 8.0.2, 8.0.2.0, 8.0.2.1 (+23)
• IBM Lotus Notes Sametime: 8.0.80407, 8.0.80822, 8.5.1.20100709-1631
• IBM Lotus Notes Traveler: 8.0, 8.0.1, 8.0.1.2, 8.0.1.3, 8.5.0.0, 8.5.0.1 (+10)
• IBM Rational Change: 4.7, 5.1, 5.2, 5.3
• IBM Rational Host On-Demand: 1.6.0.12, 8.0.8.0, 9.0.8.0, 10.0.9.0, 10.0.10.0, 11.0.3.0 (+5)
• IBM Service Delivery Manager: 7.2.1.0, 7.2.2.0
• IBM Smart Analytics System 5600: 7200
• IBM Smart Analytics System 5600 Software: 9.7
• IBM Tivoli Monitoring: 6.1.0, 6.1.0.7, 6.2.0, 6.2.0.1, 6.2.0.2, 6.2.0.3 (+21)
• IBM Tivoli Remote Control: 5.1.2
• IBM Websphere Real Time: 2.0, 3.0
• Tivoli Storage Productivity Center 5.0: all versions
• Tivoli Storage Productivity Center 5.1: all versions
• Tivoli Storage Productivity Center 5.1.1: all versions

References

• http://rhn.redhat.com/errata/RHSA-2012-1465.html
• http://rhn.redhat.com/errata/RHSA-2012-1466.html
• http://rhn.redhat.com/errata/RHSA-2012-1467.html
• http://rhn.redhat.com/errata/RHSA-2013-1455.html
• http://rhn.redhat.com/errata/RHSA-2013-1456.html
• http://seclists.org/bugtraq/2012/Sep/38
• http://secunia.com/advisories/51326
• http://secunia.com/advisories/51327
• http://secunia.com/advisories/51328
• http://secunia.com/advisories/51393
• http://secunia.com/advisories/51634
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV29654

Get alerted when CVE-2012-4820 or the next vulnerability affects your stack