Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.10.1-1jpp.5.el6_2 | RHSA-2012:0514 |
| RHEL 6 | java-1.6.0-sun +5 | 1:1.6.0.31-1jpp.1.el6_2 | RHSA-2012:0139 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.10.1-1jpp.1.el5 | RHSA-2012:0514 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.31-1jpp.1.el5 | RHSA-2012:0139 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.31-1jpp.1.el4 | RHSA-2012:0139 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.14.0-1jpp.1.el5_9 | RHSA-2013:1455 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Sun Java Web Start Plugin Command Line Argument Injection
exploit/windows/browser/java_ws_vmargs
Exploit-DB 1
- Sun Java Web Start Plugin - Command Line Argument Injection (2012) (Metasploit) EDB-18520 · remote · Feb 24, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2013:1455 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0514 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0139 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- HPSBUX02784 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html
- HPSBMU02799 vendor-advisory
- 48589 third-party-advisory
- 52015 vdb-entry
- RHSA-2013:1455 vendor-advisory
- SUSE-SU-2012:0603 vendor-advisory
- 48073 third-party-advisory
- 48950 third-party-advisory
- HPSBUX02757 vendor-advisory
- SSRT100867 vendor-advisory
- RHSA-2012:0514 vendor-advisory
- oval:org.mitre.oval:def:14844 vdb-entry signature