CVE-2012-4820
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and...
9.3 HighFix available
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to "insecure use of the java.lang.reflect.Method invoke() method."
Exploit likelihood
5.09%Up 0.7 points since Feb 4, 2022
What each source reports
NVD Score used
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to "insecure use of the java.lang.reflect.Method invoke() method."
- Record
CVE-2012-4820- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to "insecure use of the java.lang.reflect.Method invoke() method."
- Record
CVE-2012-4820- Updated
- 2026-11-02
EUVDEUVD-2012-4745 No score
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to "insecure use of the java.lang.reflect.Method invoke() method."
- Record
EUVD-2012-4745- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jfrg-75v5-493f No score
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and...
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to "insecure use of the java.lang.reflect.Method invoke() method."
- Record
GHSA-jfrg-75v5-493f- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.5.0-ibmRed Hat:rhel_extras:5::client |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::client |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::client |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::client |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::client |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::client |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::client |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::client |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibmRed Hat:rhel_extras:5::server |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::server |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
Show 64 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::server |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::server |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::server |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::server |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::server |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::server |
before 1:1.5.0.15.0-1jpp.1.el5_8 | 1:1.5.0.15.0-1jpp.1.el5_8 |
java-1.5.0-ibmRed Hat:rhel_extras:6 |
before 1:1.5.0.15.0-1jpp.1.el6_3 | 1:1.5.0.15.0-1jpp.1.el6_3 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:6 |
before 1:1.5.0.15.0-1jpp.1.el6_3 | 1:1.5.0.15.0-1jpp.1.el6_3 |
java-1.5.0-ibm-develRed Hat:rhel_extras:6 |
before 1:1.5.0.15.0-1jpp.1.el6_3 | 1:1.5.0.15.0-1jpp.1.el6_3 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:6 |
before 1:1.5.0.15.0-1jpp.1.el6_3 | 1:1.5.0.15.0-1jpp.1.el6_3 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:6 |
before 1:1.5.0.15.0-1jpp.1.el6_3 | 1:1.5.0.15.0-1jpp.1.el6_3 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:6 |
before 1:1.5.0.15.0-1jpp.1.el6_3 | 1:1.5.0.15.0-1jpp.1.el6_3 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:6 |
before 1:1.5.0.15.0-1jpp.1.el6_3 | 1:1.5.0.15.0-1jpp.1.el6_3 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server |
before 1:1.6.0.12.0-1jpp.1.el5_8 | 1:1.6.0.12.0-1jpp.1.el5_8 |
java-1.6.0-ibmRed Hat:rhel_extras:6 |
before 1:1.6.0.12.0-1jpp.1.el6_3 | 1:1.6.0.12.0-1jpp.1.el6_3 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:6 |
before 1:1.6.0.12.0-1jpp.1.el6_3 | 1:1.6.0.12.0-1jpp.1.el6_3 |
java-1.6.0-ibm-develRed Hat:rhel_extras:6 |
before 1:1.6.0.12.0-1jpp.1.el6_3 | 1:1.6.0.12.0-1jpp.1.el6_3 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:6 |
before 1:1.6.0.12.0-1jpp.1.el6_3 | 1:1.6.0.12.0-1jpp.1.el6_3 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:6 |
before 1:1.6.0.12.0-1jpp.1.el6_3 | 1:1.6.0.12.0-1jpp.1.el6_3 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:6 |
before 1:1.6.0.12.0-1jpp.1.el6_3 | 1:1.6.0.12.0-1jpp.1.el6_3 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:6 |
before 1:1.6.0.12.0-1jpp.1.el6_3 | 1:1.6.0.12.0-1jpp.1.el6_3 |
java-1.7.0-ibmRed Hat:rhel_extras:6 |
before 1:1.7.0.3.0-1jpp.2.el6_3 | 1:1.7.0.3.0-1jpp.2.el6_3 |
java-1.7.0-ibm-demoRed Hat:rhel_extras:6 |
before 1:1.7.0.3.0-1jpp.2.el6_3 | 1:1.7.0.3.0-1jpp.2.el6_3 |
java-1.7.0-ibm-develRed Hat:rhel_extras:6 |
before 1:1.7.0.3.0-1jpp.2.el6_3 | 1:1.7.0.3.0-1jpp.2.el6_3 |
java-1.7.0-ibm-jdbcRed Hat:rhel_extras:6 |
before 1:1.7.0.3.0-1jpp.2.el6_3 | 1:1.7.0.3.0-1jpp.2.el6_3 |
java-1.7.0-ibm-pluginRed Hat:rhel_extras:6 |
before 1:1.7.0.3.0-1jpp.2.el6_3 | 1:1.7.0.3.0-1jpp.2.el6_3 |
java-1.7.0-ibm-srcRed Hat:rhel_extras:6 |
before 1:1.7.0.3.0-1jpp.2.el6_3 | 1:1.7.0.3.0-1jpp.2.el6_3 |
java-1.4.2-ibmRed Hat:rhel_extras:5::client |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-demoRed Hat:rhel_extras:5::client |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-develRed Hat:rhel_extras:5::client |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-javacommRed Hat:rhel_extras:5::client |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-jdbcRed Hat:rhel_extras:5::client |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-pluginRed Hat:rhel_extras:5::client |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-srcRed Hat:rhel_extras:5::client |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibmRed Hat:rhel_extras:5::server |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-demoRed Hat:rhel_extras:5::server |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-develRed Hat:rhel_extras:5::server |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-javacommRed Hat:rhel_extras:5::server |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-jdbcRed Hat:rhel_extras:5::server |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-pluginRed Hat:rhel_extras:5::server |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.4.2-ibm-srcRed Hat:rhel_extras:5::server |
before 0:1.4.2.13.14-1jpp.1.el5_8 | 0:1.4.2.13.14-1jpp.1.el5_8 |
java-1.6.0-ibmRed Hat:network_satellite:5.4::el5 |
before 1:1.6.0.14.0-1jpp.1.el5_9 | 1:1.6.0.14.0-1jpp.1.el5_9 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.4::el5 |
before 1:1.6.0.14.0-1jpp.1.el5_9 | 1:1.6.0.14.0-1jpp.1.el5_9 |
java-1.6.0-ibmRed Hat:network_satellite:5.4::el6 |
before 1:1.6.0.14.0-1jpp.1.el6_4 | 1:1.6.0.14.0-1jpp.1.el6_4 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.4::el6 |
before 1:1.6.0.14.0-1jpp.1.el6_4 | 1:1.6.0.14.0-1jpp.1.el6_4 |
java-1.6.0-ibmRed Hat:network_satellite:5.5::el5 |
before 1:1.6.0.14.0-1jpp.1.el5_9 | 1:1.6.0.14.0-1jpp.1.el5_9 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.5::el5 |
before 1:1.6.0.14.0-1jpp.1.el5_9 | 1:1.6.0.14.0-1jpp.1.el5_9 |
java-1.6.0-ibmRed Hat:network_satellite:5.5::el6 |
before 1:1.6.0.14.0-1jpp.1.el6_4 | 1:1.6.0.14.0-1jpp.1.el6_4 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.5::el6 |
before 1:1.6.0.14.0-1jpp.1.el6_4 | 1:1.6.0.14.0-1jpp.1.el6_4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-4820 is a high vulnerability (CVSS 9.3) in Ibm Java, published January 11, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.09%, the 92nd percentile. Fixed in java-1.5.0-ibm 1:1.5.0.15.0-1jpp.1.el5_8.
References
rhn.redhat.com/errata/RHSA-2012-1466.html
www-01.ibm.com/support/docview.wss?uid=swg21616616
seclists.org/bugtraq/2012/Sep/38
Show 194 moreShow less
securityfocus.com/bid/55495
secunia.com/advisories/51327
www-304.ibm.com/support/docview.wss?uid=swg21616546
exchange.xforce.ibmcloud.com/vulnerabilities/78764
nvd.nist.gov/vuln/detail/CVE-2012-4820
github.com/advisories/GHSA-jfrg-75v5-493f
access.redhat.com/errata/RHSA-2012:1465
ibm.com/developerworks/java/jdk/alerts
bugzilla.redhat.com/show_bug.cgi?id=865346
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1465.json
cve.org/CVERecord?id=CVE-2012-1531
oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html
xforce.iss.net/xforce/xfdb/78764
cisa.gov/known-exploited-vulnerabilities-catalog
isg.rhul.ac.uk/tls
openssl.org/news/secadv_20130205.txt
polarssl.org/tech-updates/releases/polarssl-1.2.5-released
kb.cert.org/vuls/id/225657
This page doesn't list everything
Left out here: 530 references. The JSON record has them.