CVE-2012-0507

CVE-2012-0507 is an 'incorrect type' (type-confusion) vulnerability in the Concurrency component of Oracle's Java Runtime Environment that corrupts memory when crafted Java content is processed. It is triggered by running malicious Java content — classically via the browser Java plugin or an exploited Java application — allowing an attacker to execute arbitrary code with the privileges of the Java process. Anyone running an affected Oracle Java SE installation is exposed, which historically included the vast majority of desktops and many servers, with 2012-era campaigns hitting Mac users via Java exploits (e.g., the SabPub backdoor) and drive-by exploit kits. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) with known ransomware use, and EPSS assigns a 98.1% probability of exploitation within 30 days (100th percentile). CVSS has not been scored in the source data, but the combined KEV/EPSS signal marks this as actively and widely exploited.

What to do: Apply Oracle's Java SE updates per CISA's required action — Oracle shipped the fix in its February 2012 Critical Patch Update, so any current, fully patched Java release clears the flaw; verify no legacy unpatched Java builds (including Apple-delivered Java on macOS, given the 2012 OS X exploitation campaigns) remain on endpoints. Remove or disable the Java browser plugin where it is not required, and restrict execution of untrusted applets and Java Web Start content.