CVE-2012-3136

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-1682...

CVE-2012-1682

CVE-2012-1682 (Beans component) and CVE-2012-4681 relate to OpenJDK/JRE sandbox bypass and remote code execution. Connected advisories (CESA-2012:1221/1222/1223) describe updates for java-1.6.0-openjdk and java-1.7.0-openjdk to fix these issues, noting that the Beans component could bypass sandbo...

CVE-2012-0547

CVE-2012-0547 is a Java SE/JRE issue affecting Oracle JRE 7u6 and earlier and 6u34 and earlier. The vulnerability is described as a security-in-depth, AWT-related issue that is not directly exploitable on its own, but can aggravate vulnerabilities that are exploitable when combined with others. A...

JRE remote code execution 0DAY-vulnerability warning-the black bar safety net

Warning: this site provides programmethodmay carry offensive,for security research and teaching purposes,at your own risk! // // CVE-2 0 1 2-XXXX Java 0day // // reported here: http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html // // secret host / ip : ok.aa24.net /...

Oracle Java findMethod findClass Security Bypass

Added: 08/30/2012 CVE: CVE-2012-4681 BID: 55213 OSVDB: 84867 Background Java is a programming language that compiles programs to bytecode, which is then executed inside a Java Virtual Machine. This is optimal for applications that must run on various hardware platforms, such as web applets. Probl...

VMware vSphere and vCOps updates to third party libraries

a. vCenter and ESX update to JRE 1.6.0 Update 31The Oracle Sun JRE is updated to version 1.6.031, which addresses multiple security issues. Oracle has documented the CVE identifiers that are addressed by this update in the Oracle Java SE Critical Patch Update Advisory of February 2012.Column 4 of...

HP Application Lifecycle Management XGO.ocx ActiveX SetShapeNodeType() Remote Code Execution

This module exploits a vulnerability within the XGO.ocx ActiveX Control installed with the HP Application Lifecycle Manager Client. The vulnerability exists in the SetShapeNodeType method, which allows the user to specify memory that will be used as an object, through the node parameter. It allow...

CVE-2012-4681

Multiple vulnerabilities in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by 1 using com.sun.beans.finder.ClassFinder.findClass and leveraging an...

Immunity Canvas: JAVA_FORNAME_GETFIELD

Name| javaforNamegetField ---|--- CVE| CVE-2012-4681 Exploit Pack| CANVAS Description| Java forName/getField Method Invocation Sandbox Bypass Notes| CVE Name: CVE-2012-4681 VENDOR: Sun Notes: There is a method invocation vulnerability using sun.awt.SunToolkit.getField This vulnerability can then ...

US-CERT Releases Oracle Java JRE 1.7 Security Advisory

US-CERT has released Vulnerability Note VU636312 to address a vulnerability in Oracle Java Runtime Environment JRE 1.7. This vulnerability may allow an attacker to execute arbitrary code on a vulnerable system. US-CERT encourages users and administrators to review Vulnerability Note VU636312. Thi...

VMSA-2012-0013:VMware vSphere and vCOps updates to third party libraries

VMSA-2012-0013.2 VMware vSphere and vCOps updates to third party libraries VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2012-0013.2 VMware Security Advisory Synopsis: VMware vSphere and vCOps updates to third party libraries VMware Security Advisory Issue date: 2012-08-30...

CVE-2012-4681

CVE-2012-4681 affects Oracle Java SE 7 (JRE) up to Update 6, and earlier; vulnerability chain bypasses SecurityManager via beans permission checks and restricted package access, using ClassFinder.findClass and reflection with a trusted immediate caller to reach private fields. Exploitation in the...

Java 1.7 -- security manager bypass

US-CERT reports: Oracle Java Runtime Environment JRE 1.7 contains a vulnerability that may allow an applet to call setSecurityManager in a way that allows setting of arbitrary permissions. By leveraging the public, privileged getField function, an untrusted Java applet can escalate its privileges...

Adobe Flash Player 11.3 - Font Parsing Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 "Adobe Flash Player 11.3 Font Parsing...

Scientific Linux Security Update : jdk (java) on SL3.x, SL4.x i386/x86_64

NOTE: This combination of rpm's replaces j2sdk-1.4.2 with jdk-1.5.0. So your java will change from version 1.4.2 to 1.5.0. We apologize if this causes any problems, but it needed to be done for security reasons. A flaw in the applet caching mechanism of the Java Runtime Environment JRE did not...

Scientific Linux Security Update : java (jdk 1.5.0) on SL4.x, SL5.x i386/x86_64

Flaws in the JRE allowed an untrusted application or applet to elevate its privileges. This could be exploited by a remote attacker to access local files or execute local applications accessible to the user running the JRE CVE-2008-1185, CVE-2008-1186 A flaw was found in the Java XSLT processing...

Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64

CVE-2009-2409 deprecate MD2 in SSL cert validation Kaminsky CVE-2009-3873 OpenJDK JPEG Image Writer quantization problem 6862968 CVE-2009-3875 OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities 6863503 CVE-2009-3876 OpenJDK ASN.1/DER input stream parser denial of service 68649...

Scientific Linux Security Update : java-1.6.0-sun on SL4.x, SL5.x i386/x86_64 (20120216)

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch page. CVE-2011-3563, CVE-2011-3571, CVE-2011-5035, CVE-2012-0498, CVE-2012-0499,...

Scientific Linux Security Update : jdk (java) on SL5.x i386/x86_64

A flaw in the applet caching mechanism of the Java Runtime Environment JRE did not correctly process the creation of network connections. A remote attacker could use this flaw to create connections to services on machines other than the one that the applet was downloaded from. CVE-2007-5232...

Oracle AutoVue SetMarkupMode ActiveX Overflow

Added: 07/17/2012 CVE: CVE-2012-0549 BID: 53077 OSVDB: 81439 Background Oracle AutoVue Enterprise Visualization is a suite of Oracle products designed to deliver a web-based capability to access, view, digitally annotate and collaborate on technical and business documents, without requiring...