CVE-2012-4681

Publication date 28 August 2012

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Read the notes from the security team

Status

Package Ubuntu Release Status
icedtea-web 12.10 quantal
Not affected
12.04 LTS precise
Not affected
11.10 oneiric
Not affected
11.04 natty
Not affected
10.04 LTS lucid
Not affected
8.04 LTS hardy Not in release
openjdk-6 12.10 quantal
Not affected
12.04 LTS precise
Not affected
11.10 oneiric
Not affected
11.04 natty
Not affected
10.04 LTS lucid
Not affected
8.04 LTS hardy Ignored end of life
openjdk-6b18 12.10 quantal Not in release
12.04 LTS precise Not in release
11.10 oneiric
Not affected
11.04 natty
Not affected
10.04 LTS lucid
Not affected
8.04 LTS hardy Not in release
openjdk-7 12.10 quantal
Not affected
12.04 LTS precise
Not affected
11.10 oneiric
Fixed 7u9-2.3.3-0ubuntu1~11.10.1
11.04 natty Not in release
10.04 LTS lucid Not in release
8.04 LTS hardy Not in release
sun-java5 12.10 quantal Not in release
12.04 LTS precise Not in release
11.10 oneiric Not in release
11.04 natty Not in release
10.04 LTS lucid Not in release
8.04 LTS hardy Ignored end of life
sun-java6 12.10 quantal Not in release
12.04 LTS precise Not in release
11.10 oneiric Not in release
11.04 natty Not in release
10.04 LTS lucid Not in release
8.04 LTS hardy Ignored end of life

Notes

mdeslaur

in lucid+, NetX and the plugin moved to the icedtea-web package

tyhicks

Per oss-security thread, OpenJDK <= 7u4-b31 is also affected sbeattie verified that the openjdk vulnerability test does not work on openjdk-6 in precise

Severity score breakdown

Parameter Value
Base score 9.8 · Critical
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H