Skip to main content
Mallory
CriticalCISA KEVExploited in the wildPublic exploit

Java Applet Field Bytecode Verifier Cache Remote Code Execution in Oracle Java HotSpot

IdentifiersCVE-2012-1723CWE-94

CVE-2012-1723 is a remote code execution vulnerability in Oracle Java Runtime Environment / Java SE affecting Java SE 7 Update 4 and earlier, 6 Update 32 and earlier, 5 Update 35 and earlier, and 1.4.2_37 and earlier. Oracle described it as an unspecified vulnerability in the JRE component related to HotSpot. Supporting content consistently identifies it as the 'Java Applet Field Bytecode Verifier Cache' issue and a classloader/type-confusion-style flaw abused through malicious Java applets delivered in JAR files. In observed exploit-kit implementations, a victim is directed to an HTML page containing an applet tag that loads a crafted JAR; successful exploitation breaks Java sandbox restrictions and permits arbitrary code download and execution. The vulnerability was widely weaponized in exploit kits including Blackhole, Sakura, Sweet Orange, Impact, LightsOut/Hello, KaiXin, DotkaChef, White Lotus, and Topic EK.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote, unauthenticated attacker to compromise confidentiality, integrity, and availability on the victim system. In practical exploitation documented in the supporting content, attackers used the flaw to escape the Java sandbox, grant code elevated permissions, download native payloads or executables from hardcoded URLs, write them to disk, and execute them. This enabled malware delivery, downloader execution, information theft, and follow-on compromise, and made the vulnerability suitable for watering-hole attacks and exploit-kit-driven mass compromise.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, disable the Java browser plugin and prevent untrusted applets from executing in browsers. Restrict or remove Java from systems that do not require it, especially internet-facing user workstations. Use browser hardening, application allowlisting, network egress controls, and web filtering to block exploit-kit landing pages and malicious JAR delivery. Monitoring for suspicious applet launches, JAR downloads, and child-process or file-write behavior from Java can reduce exposure while patching is completed.

Remediation

Patch, then assume compromise.

Upgrade Oracle Java to a version that includes Oracle's fix for CVE-2012-1723. At minimum, move off affected releases: Java SE 7 Update 4 and earlier, 6 Update 32 and earlier, 5 Update 35 and earlier, and 1.4.2_37 and earlier. Remove or disable outdated JRE/JDK installations, especially legacy Java 6 and Java 7 runtimes that remain installed side-by-side. Apply vendor security updates across endpoints and browsers, and verify that vulnerable browser plugin components are no longer present.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
OracleJdkapplication
OracleJreapplication
Red HatEnterprise Linux Desktopoperating_system
Red HatEnterprise Linux Eusoperating_system
Red HatEnterprise Linux Serveroperating_system
Red HatEnterprise Linux Server Ausoperating_system
Red HatEnterprise Linux Workstationoperating_system
Red HatIcedtea6application

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence4

Every observed campaign linking this CVE to a named adversary.

Associated malware9

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.