Oracle Java Multiple Vulnerabilities

SA50949

CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-3143, CVE-2012-3159, CVE-2012-3216, CVE-2012-4416, CVE-2012-5067, CVE-2012-5068, CVE-2012-5069, CVE-2012-5070, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5074, CVE-2012-5075, CVE-2012-5076, CVE-2012-5077, CVE-2012-5078, CVE-2012-5079, CVE-2012-5080, CVE-2012-5081, CVE-2012-5082, CVE-2012-5083, CVE-2012-5084, CVE-2012-5085, CVE-2012-5086, CVE-2012-5087, CVE-2012-5088, CVE-2012-5089

17 Oct 2012

Highly Critical

Vendor Patch

Oracle Java JDK 1.5.x / 5.x
Oracle Java JDK 1.7.x / 7.x
Oracle Java JRE 1.4.x / 4.x
Oracle Java JRE 1.7.x / 7.x
Oracle Java SDK 1.4.x / 4.x
Oracle JavaFX 2.x
Sun Java JDK 1.6.x / 6.x
Sun Java JRE 1.5.x / 5.x
Sun Java JRE 1.6.x / 6.x

From remote

DoS (Denial of Service)

This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Manipulation of data

This includes vulnerabilities where a user or a remote attacker can manipulate local data on a system, but not necessarily be able to gain escalated privileges or system access.

The most frequent type of vulnerabilities with this impact are SQL-injection vulnerabilities, where a malicious user or person can manipulate SQL queries.

Multiple vulnerabilities have been reported in Oracle Java, which can be exploited by malicious people to disclose potentially sensitive information, manipulate certain data, cause a DoS (Denial of Service), and potentially compromise a vulnerable system.

1) An unspecified error in the 2D component of the client and server deployment can be exploited to potentially execute arbitrary code.

2) An unspecified error in the 2D component of the client and server deployment can be exploited to potentially execute arbitrary code.

3) An unspecified error in the Beans component of the client deployment can be exploited to potentially execute arbitrary code.

4) An unspecified error in the Beans component of the client deployment can be exploited to potentially execute arbitrary code.

5) An unspecified error in the Deployment component of the client deployment can be exploited to potentially execute arbitrary code.

6) An unspecified error in the Deployment component of the client deployment can be exploited to potentially execute arbitrary code.

7) An unspecified error in the JAX-WS component of the client deployment can be exploited to potentially execute arbitrary code.

8) An unspecified error in the JMX component of the client deployment can be exploited to potentially execute arbitrary code.

9) An unspecified error in the Libraries component of the client deployment can be exploited to potentially execute arbitrary code.

10) An unspecified error in the JavaFX component of the client deployment can be exploited to potentially execute arbitrary code.

11) An unspecified error in the JMX component of the client deployment can be exploited to potentially execute arbitrary code.

12) An unspecified error in the Swing component of the client deployment can be exploited to potentially execute arbitrary code.

13) An unspecified error in the JavaFX component of the client deployment can be exploited to potentially execute arbitrary code.

14) An unspecified error in the Deployment component of the client deployment can be exploited to disclose and manipulate certain data and cause a DoS.

15) An unspecified error in the Libraries component of the client deployment can be exploited to disclose and manipulate certain data and cause a DoS.

16) An unspecified error in the Hotspot component of the client deployment can be exploited to disclose and manipulate certain data.

17) An unspecified error in the JAX-WS component of the client deployment can be exploited to disclose and manipulate certain data.

18) An unspecified error in the JMX component of the client deployment can be exploited to disclose and manipulate certain data.

19) An unspecified error in the Concurrency component of the client deployment can be exploited to disclose and manipulate certain data.

20) An unspecified error in the Deployment component of the client deployment can be exploited to disclose certain data.

21) An unspecified error in the JMX component of the client deployment can be exploited to disclose certain data.

22) An unspecified error in the JMX component of the client deployment can be exploited to disclose certain data.

23) An unspecified error in the Libraries component of the client deployment can be exploited to manipulate certain data.

24) An unspecified error in the Libraries component of the client deployment can be exploited to manipulate certain data.

25) An unspecified error in the Security component of the client deployment can be exploited to disclose certain data.

26) An unspecified error in the JSSE component of the server deployment can be exploited to cause a DoS.

27) An unspecified error in the JavaFX component of the client deployment can be exploited to cause a DoS.

28) An unspecified error in the Libraries component of the client deployment can be exploited to disclose certain data.

29) An unspecified error in the Security component of the client deployment can be exploited to disclose certain data.

The vulnerabilities are reported in the following products:
* JDK and JRE 7 Update 7 and earlier.
* JDK and JRE 6 Update 35 and earlier.
* JDK and JRE 5.0 Update 36 and earlier.
* SDK and JRE 1.4.2_38 and earlier.
* JavaFX 2.2 and earlier.

Apply updates.

It is currently unclear who reported these vulnerabilities as the Oracle Jave SE Critical Patch Update for October 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Oracle:
http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html