CVE-2012-4420 : An information disclosure flaw was found in the way the Java Virtual Machine (JV

An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.

Published 2019-12-26 21:15:11

Updated 2020-01-14 17:33:36

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2012-4420

Oracle » JDK » Version: 7.0
cpe:2.3:a:oracle:jdk:7.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2012-4420

EPSS FAQ

0.80%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 82 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-4420

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2012-4420

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-4420

http://www.openwall.com/lists/oss-security/2012/09/13/3

oss-security - Re: CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs)
Mailing List;Third Party Advisory
https://www.openwall.com/lists/oss-security/2012/09/12/4

oss-security - Re: CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs)
Mailing List;Third Party Advisory
http://www.securityfocus.com/bid/55538

OpenJDK Java Virtual Machine (JVM) CVE-2012-4420 Remote Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/78693

OpenJDK Java Virtual Machine (JVM) information disclosure CVE-2012-4420 Vulnerability Report
Third Party Advisory;VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4420

856588 – (CVE-2012-4420) CVE-2012-4420 java-1.7.0-openjdk: JVM heap memory disclosure
Issue Tracking;Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-4420

CVE-2012-4420- Red Hat Customer Portal
Third Party Advisory
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7196857

Bug ID: JDK-7196857 Int array initializes with nonzero elements.
Exploit;Issue Tracking;Third Party Advisory

Jump to

Vulnerability Details : CVE-2012-4420

Products affected by CVE-2012-4420

Exploit prediction scoring system (EPSS) score for CVE-2012-4420

CVSS scores for CVE-2012-4420

CWE ids for CVE-2012-4420

References for CVE-2012-4420