Loading vulnerability…
CVE-2012-0507 is a vulnerability in Oracle Java SE affecting the Java Runtime Environment in Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier. The issue was associated with the Concurrency component and was widely reported as involving the AtomicReferenceArray implementation failing to ensure that the backing array is of type Object[]. This type confusion condition can allow crafted Java content, such as a malicious applet delivered through a web page, to violate expected type safety guarantees inside the JVM. Successful exploitation can crash the JVM or bypass Java sandbox restrictions, enabling execution of attacker-controlled code outside the intended security boundary.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module (modules/exploits/multi/browser/java_atomicreferencearray.rb) that exploits CVE-2012-0507, a type confusion vulnerability in Java's AtomicReferenceArray. The exploit is delivered via a malicious HTTP server that serves an HTML page with an embedded Java applet. When a vulnerable client visits the page, the applet loads a malicious JAR file (CVE-2012-0507.jar) that escapes the Java sandbox and executes arbitrary code. The module supports multiple payloads, including Java-based and native payloads for Windows, Mac OS X, and Linux. The attacker can configure the payload to provide a reverse shell or execute arbitrary commands on the victim's machine. The exploit is weaponized, as it is part of the Metasploit framework and allows for easy payload customization. The main fingerprintable endpoint is the JAR file served to the victim. The module is cross-platform and targets any system running a vulnerable version of Java.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Java Runtime Environment vulnerability in Oracle Java SE referenced as exploited.
A vulnerability heavily used by ransomware variants (details not specified in content).
A Java vulnerability known as Java Atomic that was widely added to exploit kits, demonstrating broad in-the-wild exploitation via malware delivery infrastructure.
A specific Java vulnerability included in the RIG exploit pack and used as part of its exploit chain.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.