Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect availability, related to JSSE.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.15.0-1jpp.1.el6_3 | RHSA-2012:1465 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.12.0-1jpp.1.el6_3 | RHSA-2012:1466 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.50.1.11.5.el6_3 | RHSA-2012:1384 |
| RHEL 6 | java-1.6.0-sun +5 | 1:1.6.0.37-1jpp.1.el6_3 | RHSA-2012:1392 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.3.0-1jpp.2.el6_3 | RHSA-2012:1467 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.9-2.3.3.el6_3.1 | RHSA-2012:1386 |
| RHEL 6 | java-1.7.0-oracle +5 | 1:1.7.0.9-1jpp.3.el6_3 | RHSA-2012:1391 |
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.13.14-1jpp.1.el5_8 | RHSA-2012:1485 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.15.0-1jpp.1.el5_8 | RHSA-2012:1465 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.12.0-1jpp.1.el5_8 | RHSA-2012:1466 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.28.1.10.10.el5_8 | RHSA-2012:1385 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.37-1jpp.1.el5_8 | RHSA-2012:1392 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.14.0-1jpp.1.el5_9 | RHSA-2013:1456, RHSA-2013:1455 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Scanner for Bleichenbacher Oracle in RSA PKCS #1 v1.5
auxiliary/scanner/ssl/bleichenbacher_oracle
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 12
- RHSA-2013:1455 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:1456 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1467 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1485 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1466 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1465 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1391 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1392 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1386 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1384 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1385 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 51313 third-party-advisory
- SUSE-SU-2012:1398 vendor-advisory
- GLSA-201406-32 vendor-advisory
- http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-023/index.html
- RHSA-2012:1466 vendor-advisory
- RHSA-2012:1386 vendor-advisory
- 51315 third-party-advisory
- 51438 third-party-advisory
- 56071 vdb-entry
- 51141 third-party-advisory
- SSRT101043 vendor-advisory
- SUSE-SU-2012:1490 vendor-advisory
- openSUSE-SU-2012:1423 vendor-advisory
- RHSA-2013:1455 vendor-advisory
- RHSA-2012:1391 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21620037
- 51029 third-party-advisory
- 51166 third-party-advisory
- 51390 third-party-advisory
- RHSA-2012:1392 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21631786
- SUSE-SU-2012:1489 vendor-advisory
- SUSE-SU-2012:1595 vendor-advisory
- 51327 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- RHSA-2012:1467 vendor-advisory
- RHSA-2012:1465 vendor-advisory
- 51328 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21620575
- SSRT101042 vendor-advisory
- 51028 third-party-advisory
- RHSA-2013:1456 vendor-advisory
- 51393 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html
- 51326 third-party-advisory
- oval:org.mitre.oval:def:16043 vdb-entry signature
- MDVSA-2013:150 vendor-advisory
- RHSA-2012:1385 vendor-advisory
- http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf