Description
An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
java-1.7.0-openjdk java-1.7.0-openjdk
1.7.0_04 to 1.7.0_10affected
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4420 ↗
- https://access.redhat.com/security/cve/cve-2012-4420 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78693 ↗
- http://www.openwall.com/lists/oss-security/2012/09/13/3 ↗
- http://www.securityfocus.com/bid/55538 ↗
- https://www.openwall.com/lists/oss-security/2012/09/12/4 ↗
- https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7196857 ↗