CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 1CVE-2012-2739
https://notcve.org/view.php?id=CVE-2012-2739
Oracle Java SE before 7 Update 6, and OpenJDK 7 before 7u6 build 12 and 8 before build 39, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. Oracle Java SE anteriores a 7 Update 6, y OpenJDK 7 anteriores a 7u6 build 12 y 8 anteriores a build 39, calculan los valores de hash sin restringir la posibilidad de provocar colisiones hash previsibles, lo que permite a atacantes dependientes de contexto provocar una denegación de servicio (consumo de CPU) a través de la manipulación de una entrada para la aplicación que mantiene la tabla de valores hash. • http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html http://www.kb.cert.org/vuls/id/903934 http://www.nruns.com/_downloads/advisory28122011.pdf http://www.ocert.org/advisories/ocert-2011-003.html http://www.openwall.com/lists/oss-security/2012/06/15/12 http://www.openwall.com/lists/oss-security/2012/06/17/1 https://bugzilla.redhat.com/show_bug.cgi?id=750533 • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2012-5373
https://notcve.org/view.php?id=CVE-2012-5373
Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm, a different vulnerability than CVE-2012-2739. Oracle Java SE 7 y anteriores, y OpenJDK 7 y anteriores, calcula los valores hash sin restringir la posibilidad de provocar colisiones hash previsibles, lo que permite a atacantes dependientes de contexto provocar una denegación de servicio (consumo de CPU) a través de la manipulación de una entrada a la aplicación que mantiene la tabla de valores hash, como se demostró con un ataque universal multicollision contra el algoritmo MurmurHash3, una vulnerabilidad diferente a CVE-2012-2739. • http://2012.appsec-forum.ch/conferences/#c17 http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf http://www.ocert.org/advisories/ocert-2012-001.html http://www.securityfocus.com/bid/56673 https://bugzilla.redhat.com/show_bug.cgi?id=880705 https://exchange.xforce.ibmcloud.com/vulnerabilities/80299 https://www.131002.net/data/talks/appsec12_slides.pdf • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 0%CPEs: 224EXPL: 0CVE-2012-5079 – OpenJDK: ServiceLoader reject not subtype classes without instantiating (Libraries, 7195919)
https://notcve.org/view.php?id=CVE-2012-5079
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries, a different vulnerability than CVE-2012-5073. Vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Oracle Java SE 7 Update 7 y versiones anteriores, 6 Update 35 y versiones anteriores, 5.0 Update 36 y versiones anteriores y 1.4.2_38 y versiones anteriores permite a atacantes remotos afectar la integridad a través de vectores desconocidos relacionados con Libraries, una vulnerabilidad diferente a CVE-2012-5073. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00022.html http://marc.info/?l=bugtraq&m=135542848327757&w=2 http://marc.info/?l=bugtraq&m=135758563611658&w=2 http://rhn.redhat •
CVSS: 5.0EPSS: 0%CPEs: 16EXPL: 0CVE-2012-5070 – OpenJDK: EnvHelp information disclosure (JMX, 7158796)
https://notcve.org/view.php?id=CVE-2012-5070
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, related to JMX. Una vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Oracle Java SE v7 Update 7 permite a atacantes remotos afectar la confidencialidad a través de vectores desconocidos relacionados con JMX. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html http://rhn.redhat.com/errata/RHSA-2012-1386.html http://rhn.redhat.com/errata/RHSA-2012-1391.html http://rhn.redhat.com/errata/RHSA-2012-1467.html http://secunia.com/advisories/51029 http://secunia.com/advisories/51326 http://secunia.com/advisories/51390 http://security.gentoo.org/glsa/glsa-201406-32.xml http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html http://www.securityfocus •
CVSS: 5.0EPSS: 0%CPEs: 16EXPL: 1CVE-2012-5067 – Java Applet - JAX-WS Remote Code Execution
https://notcve.org/view.php?id=CVE-2012-5067
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Una vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Oracle Java SE v7 Update 7 y versiones anteriores, permite a atacantes remotos afectar la confidencialidad a través de vectores desconocidos relacionados con el "Deployment". • https://www.exploit-db.com/exploits/22657 http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html http://rhn.redhat.com/errata/RHSA-2012-1391.html http://rhn.redhat.com/errata/RHSA-2012-1467.html http://secunia.com/advisories/51326 http://secunia.com/advisories/51390 http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html http://www.securityfocus.com/bid/56070 https://exchange.xforce.ibmcloud.com/vulnerabilities/79429 https://oval.cisecurity.org& •