Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
Oracle Java 7 Update 6, y posiblemente otras versiones, permite a atacantes remotos ejecutar código arbitrario a través de un applet manipulado, explotado como en la naturaleza, en agosto de 2012 utilizando Gondzz.class y Gondvv.class.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:C/I:C/A:C
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | COMPLETE |
| Integrity Impact | COMPLETE |
| Availability Impact | COMPLETE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-Other
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-284
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60a8d280c0> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116a9300> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60a8d2a500> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60e8848980> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60bbd1b400> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60bbd1ab40> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116a98c0> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60a8822c80> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60e8848d00> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60bbd1ac80> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60e884ac80> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60a8823ec0> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60bbd1a8c0> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60b8460a80> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60a8d2a4c0> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60e884b580> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e613c198f40> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60a8d2ba00> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116aae80> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60e8848100> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60b8461100> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60e884b980> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60bbd19f40> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116aab40> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60e884a200> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60a8d2a800> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e60e884bc40> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116ab540> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116a9f00> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116a9180> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116abdc0> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116aa6c0> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116aa680> | Application |
| oracle | jdk | 1.6.0 | <built-in method update of dict object at 0x7e61116aa740> | Application |
| oracle | jdk | 1.7.0 | <built-in method update of dict object at 0x7e61116a8400> | Application |
| oracle | jdk | 1.7.0 | <built-in method update of dict object at 0x7e61116ab980> | Application |
| oracle | jdk | 1.7.0 | <built-in method update of dict object at 0x7e61116a9d00> | Application |
| oracle | jdk | 1.7.0 | <built-in method update of dict object at 0x7e61116abc40> | Application |
| oracle | jdk | 1.7.0 | <built-in method update of dict object at 0x7e61116a9440> | Application |
| oracle | jdk | 1.7.0 | <built-in method update of dict object at 0x7e61116a8500> | Application |
| oracle | jdk | 1.7.0 | <built-in method update of dict object at 0x7e61116a90c0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e61116aad80> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e61116a8a40> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e61116abf00> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e61116ab140> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e61116aba00> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e61116a9fc0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e61116a9080> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60a8822000> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60a8823500> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e61116ab7c0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb241c40> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60e884acc0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb243000> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb240f00> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb243440> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb243340> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb242e40> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb240cc0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb2432c0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb240940> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e6112e766c0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60a8d2aa40> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e6112ef1780> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb243e00> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb2437c0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60a8822640> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb243a40> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb241280> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb2438c0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb2424c0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60a8823740> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb2423c0> | Application |
| oracle | jre | 1.6.0 | <built-in method update of dict object at 0x7e60eb2405c0> | Application |
| oracle | jre | 1.7.0 | <built-in method update of dict object at 0x7e60eb243cc0> | Application |
| oracle | jre | 1.7.0 | <built-in method update of dict object at 0x7e60bbcf2480> | Application |
| oracle | jre | 1.7.0 | <built-in method update of dict object at 0x7e60bbcf1380> | Application |
| oracle | jre | 1.7.0 | <built-in method update of dict object at 0x7e60bbcf02c0> | Application |
| oracle | jre | 1.7.0 | <built-in method update of dict object at 0x7e60bbcf3780> | Application |
| oracle | jre | 1.7.0 | <built-in method update of dict object at 0x7e60bbcf2d00> | Application |
| oracle | jre | 1.7.0 | <built-in method update of dict object at 0x7e60bbcf2640> | Application |
| redhat | enterprise_linux_desktop | 6.0 | <built-in method update of dict object at 0x7e60bbcf3680> | Operating System |
| redhat | enterprise_linux_eus | 6.3 | <built-in method update of dict object at 0x7e60bbcf3b80> | Operating System |
| redhat | enterprise_linux_server | 6.0 | <built-in method update of dict object at 0x7e60bbcf1340> | Operating System |
| redhat | enterprise_linux_workstation | 6.0 | <built-in method update of dict object at 0x7e60bbcf3e80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update15:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update16:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update17:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update18:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update19:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update20:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update21:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update27:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update29:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update30:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update31:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update32:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update33:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update34:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update4:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update5:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update6:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update7:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update8:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.6.0:update9:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.7.0:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update10:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update11:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update12:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update13:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update14:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update15:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update16:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update17:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update18:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update19:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update20:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update21:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update30:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update31:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update32:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update33:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update34:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update4:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update5:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update6:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update7:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.6.0:update9:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* |