Unscored severity · published Jan 11, 2013
CVE-2012-4821
Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142…
–
CVSS
6.9%
EPSS
No
On KEV
Description
Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, allow remote attackers to execute arbitrary code via "insecure use" of the (1) java.lang.Class getDeclaredMethods or nd (2) java.lang.reflect.AccessibleObject setAccessible() methods.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.9% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
50
5.0 · Tivoli Storage Productivity Center
All versions, or not specified · source: NVD
51
5.1 · Tivoli Storage Productivity Center
All versions, or not specified · source: NVD
51
5.1.1 · Tivoli Storage Productivity Center
All versions, or not specified · source: NVD
JA
Java · Ibm
1.4.2 through 1.4.2.13.13; 5.0.0.0 through 5.0.14.0; 6.0.0.0 through 6.0.11.0; 7.0.0.0 through 7.0.2.0 · source: NVD
LD
Lotus Domino · Ibm
8.0; 8.0.1; 8.0.2; 8.0.2.1; 8.0.2.2; 8.0.2.3; +17 more · source: NVD
LN
Lotus Notes · Ibm
8.0; 8.0.0; 8.0.1; 8.0.2; 8.0.2.0; 8.0.2.1; +23 more · source: NVD
LN
Lotus Notes Sametime · Ibm
8.0.80407; 8.0.80822; 8.5.1.20100709-1631 · source: NVD
LN
Lotus Notes Traveler · Ibm
8.0; 8.0.1; 8.0.1.2; 8.0.1.3; 8.5.0.0; 8.5.0.1; +10 more · source: NVD
RC
Rational Change · Ibm
4.7; 5.1; 5.2; 5.3 · source: NVD
RH
Rational Host On-demand · Ibm
1.6.0.12; 8.0.8.0; 9.0.8.0; 10.0.9.0; 10.0.10.0; 11.0.3.0; +5 more · source: NVD
SD
Service Delivery Manager · Ibm
7.2.1.0; 7.2.2.0 · source: NVD
SA
Smart Analytics System 5600 · Ibm
7200 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4821
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4821
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1467.html
Mailing List
http://seclists.org/bugtraq/2012/Sep/38
Third Party Advisory
http://secunia.com/advisories/51326
Third Party Advisory
http://secunia.com/advisories/51634
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV29659
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21615705
More from Java
9.8
CVE-2015-0192
Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to…
7.8
CVE-2019-4473
Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by…
7.5
CVE-2023-30441
IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and…
7.5
CVE-2015-1916
Unspecified vulnerability in IBM Java 8 before SR1 allows remote attackers to cause a denial of service via unknown vectors related to SSL/TLS and the Secure Socket Extension…
–
CVE-2015-1914
IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to bypass "permission checks" and obtain sensitive…