PT-2013-1666 · Oracle · Javafx

Published 2013-02-02 · Updated 2017-09-19 · CVE-2012-4305

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions JavaFX versions 2.2.4 and earlier

Description The issue affects confidentiality, integrity, and availability. It is reportedly different from other vulnerabilities listed in the February 2013 CPU. There are claims from a third party that it may allow remote attackers to execute arbitrary code, possibly related to an "invalid type cast" and exposed native methods in the T2KGlyph class.

Recommendations For JavaFX versions 2.2.4 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2012-4305

Affected Products

Javafx

References · 7

• http://oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=136733161405818&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4305 · Security Note
• http://verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=1030 · Note
• http://us-cert.gov/cas/techalerts/TA13-032A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16392 · Note
• http://kb.cert.org/vuls/id/858729 · Note