製品・ソフトウェアに関する情報

JVN脆弱性詳細

Oracle Java SE の Java Runtime Environment (JRE) における JAXP の処理に関する脆弱性

Title	Oracle Java SE の Java Runtime Environment (JRE) における JAXP の処理に関する脆弱性
Summary	Oracle Java SE の Java Runtime Environment (JRE) には、JAXP に関する処理に不備があるため、可用性に影響のある脆弱性が存在します。
Possible impacts	第三者により、サービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 12, 2012, midnight
Registration Date	June 19, 2012, 3:58 p.m.
Last Update	Oct. 22, 2012, 2:01 p.m.

CVSS2.0 : 警告
Score	5
Vector	AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected System

サン・マイクロシステムズ

JDK 6 update 32 およびそれ以前

JDK 7 update 4 およびそれ以前

JRE 6 update 32 およびそれ以前

JRE 7 update 4 およびそれ以前

アップル

Apple Mac OS X v10.6.8

Apple Mac OS X v10.7.4

Apple Mac OS X Server v10.6.8

Apple Mac OS X Server v10.7.4

日立

Cosminexus Application Server Enterprise Version 6

Cosminexus Application Server Standard Version 6

Cosminexus Application Server Version 5

Cosminexus Client Version 6

Cosminexus Developer Light Version 6

Cosminexus Developer Professional Version 6

Cosminexus Developer Standard Version 6

Cosminexus Developer Version 5

Cosminexus Developer's Kit for Java(TM)

Cosminexus Primary Server Base

Cosminexus Server - Standard Edition Version 4

Cosminexus Server - Web Edition Version 4

Cosminexus Studio - Standard Edition Version 4

Cosminexus Studio - Web Edition Version 4

Cosminexus Studio Version 5

Cosminexus XML Processor

HiRDB for Java(TM)/XML

Hitachi Developer's Kit for Java

Processing Kit for XML

uCosminexus Application Server Enterprise

uCosminexus Application Server Express

uCosminexus Application Server Light

uCosminexus Application Server Smart Edition

uCosminexus Application Server Standard

uCosminexus Application Server Standard-R

uCosminexus Client

uCosminexus Client for Plug-in

uCosminexus Developer 01

uCosminexus Developer Light

uCosminexus Developer Professional

uCosminexus Developer Professional for Plug-in

uCosminexus Developer Standard

uCosminexus Operator

uCosminexus Portal Framework エントリセット

uCosminexus Primary Server Base

uCosminexus Service Architect

uCosminexus Service Platform

uCosminexus Service Platform - Messaging

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-1724	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1724
National Vulnerability Database (NVD)
2	CVE-2012-1724	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1724

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT5319	http://support.apple.com/kb/HT5319
Hitachi Software Vulnerability Information
2	HS12-015	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-015/index.html
3	HS12-016	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-016/index.html
HP Support document
4	HPSBUX02805 SSRT100919	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c03441075
Oracle Critical Patch Update
5	Oracle Critical Patch Update Advisory - July 2012	http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
6	Oracle Java SE Critical Patch Update Advisory - June 2012	http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html
7	Text Form of Oracle Java SE Critical Patch Update - June 2012 Risk Matrices	http://www.oracle.com/technetwork/topics/security/javacpujun2012verbose-1515971.html
SECURITY BLOG
8	June 2012 Critical Patch Update for Java SE Released	https://blogs.oracle.com/security/entry/june_2012_critical_patch_update
ソフトウェア製品セキュリティ情報
9	HS12-015	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS12-015/index.html
10	HS12-016	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS12-016/index.html
富士通セキュリティ情報
11	Oracle Corporation Javaプラグインの脆弱性に関するお知らせ	http://www.fmworld.net/biz/common/oracle/20120614.html

その他

No	Name	URL
JVN
1	JVNVU#162931	http://jvn.jp/cert/JVNVU162931

Change Log

No	Changed Details	Date of change
0	[2012年06月19日] 掲載 [2012年07月25日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2012) を追加 [2012年10月22日] ベンダ情報：ヒューレット・パッカード (HPSBUX02805 SSRT100919) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-1724

Summary	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect availability, related to JAXP.
Publication Date	June 17, 2012, 6:55 a.m.
Registration Date	Jan. 28, 2021, 2:56 p.m.
Last Update	Nov. 21, 2024, 10:37 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jre::update4::::::*		1.7.0
cpe:2.3:a:oracle:jre:1.7.0:update3::::::
cpe:2.3:a:oracle:jdk:1.7.0:update2::::::
cpe:2.3:a:oracle:jdk:1.7.0:::::::*
cpe:2.3:a:oracle:jdk::update4::::::*		1.7.0
cpe:2.3:a:oracle:jre:1.7.0:update2::::::
cpe:2.3:a:oracle:jdk:1.7.0:update3::::::
cpe:2.3:a:oracle:jre:1.7.0:::::::*
cpe:2.3:a:oracle:jdk:1.7.0:update1::::::
cpe:2.3:a:oracle:jre:1.7.0:update1::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:sun:jdk:1.6.0:update_4::::::
cpe:2.3:a:sun:jre:1.6.0:update_3::::::
cpe:2.3:a:sun:jre:1.6.0:update_5::::::
cpe:2.3:a:sun:jdk:1.6.0:update_7::::::
cpe:2.3:a:sun:jdk:1.6.0:update_19::::::
cpe:2.3:a:sun:jdk:1.6.0:update_13::::::
cpe:2.3:a:sun:jre:1.6.0:update_13::::::
cpe:2.3:a:sun:jre:1.6.0:update_1::::::
cpe:2.3:a:sun:jre:1.6.0:update_2::::::
cpe:2.3:a:sun:jdk:1.6.0:update_3::::::
cpe:2.3:a:sun:jre:1.6.0:update_16::::::
cpe:2.3:a:sun:jdk:1.6.0:update_11::::::
cpe:2.3:a:sun:jre:1.6.0:update_20::::::
cpe:2.3:a:sun:jdk:1.6.0:update_10::::::
cpe:2.3:a:sun:jre:1.6.0:update_15::::::
cpe:2.3:a:sun:jre:1.6.0:update_6::::::
cpe:2.3:a:sun:jdk:1.6.0:update_14::::::
cpe:2.3:a:sun:jdk:1.6.0:::::::*
cpe:2.3:a:sun:jdk:1.6.0:update_17::::::
cpe:2.3:a:sun:jre:1.6.0:update_19::::::
cpe:2.3:a:sun:jre:1.6.0:::::::*
cpe:2.3:a:sun:jdk:1.6.0:update_5::::::
cpe:2.3:a:sun:jre:1.6.0:update_18::::::
cpe:2.3:a:sun:jdk:1.6.0:update2::::::
cpe:2.3:a:sun:jdk:1.6.0:update_20:x64:::::*
cpe:2.3:a:sun:jre:1.6.0:update_10::::::
cpe:2.3:a:sun:jdk:1.6.0:update1_b06::::::
cpe:2.3:a:sun:jdk:1.6.0:update_21::::::
cpe:2.3:a:sun:jdk:1.6.0:update_16::::::
cpe:2.3:a:sun:jdk:1.6.0:update1::::::
cpe:2.3:a:sun:jre:1.6.0:update_17::::::
cpe:2.3:a:sun:jre:1.6.0:update_21::::::
cpe:2.3:a:sun:jre:1.6.0:update_7::::::
cpe:2.3:a:sun:jre:1.6.0:update_14::::::
cpe:2.3:a:sun:jdk:1.6.0:update_15::::::
cpe:2.3:a:sun:jdk:1.6.0:update_12::::::
cpe:2.3:a:sun:jre:1.6.0:update_4::::::
cpe:2.3:a:sun:jdk:1.6.0:update_18::::::
cpe:2.3:a:sun:jdk:1.6.0:update_6::::::
cpe:2.3:a:sun:jdk:1.6.0:update_20::::::
cpe:2.3:a:sun:jre:1.6.0:update_12::::::
cpe:2.3:a:sun:jre:1.6.0:update_11::::::
cpe:2.3:a:oracle:jdk:1.6.0:update25::::::
cpe:2.3:a:oracle:jdk:1.6.0:update29::::::
cpe:2.3:a:oracle:jdk:1.6.0:update31::::::
cpe:2.3:a:oracle:jdk:1.6.0:update27::::::
cpe:2.3:a:oracle:jdk:1.6.0:update24::::::
cpe:2.3:a:oracle:jdk:1.6.0:update23::::::
cpe:2.3:a:oracle:jdk:1.6.0:update22::::::
cpe:2.3:a:oracle:jdk:1.6.0:update26::::::
cpe:2.3:a:oracle:jdk:1.6.0:update30::::::
cpe:2.3:a:oracle:jdk::update32::::::*		1.6.0
cpe:2.3:a:oracle:jre:1.6.0:update30::::::
cpe:2.3:a:oracle:jre:1.6.0:update25::::::
cpe:2.3:a:oracle:jre:1.6.0:update24::::::
cpe:2.3:a:oracle:jre:1.6.0:update26::::::
cpe:2.3:a:oracle:jre::update32::::::*		1.6.0
cpe:2.3:a:oracle:jre:1.6.0:update27::::::
cpe:2.3:a:oracle:jre:1.6.0:update22::::::
cpe:2.3:a:oracle:jre:1.6.0:update31::::::
cpe:2.3:a:oracle:jre:1.6.0:update23::::::
cpe:2.3:a:oracle:jre:1.6.0:update29::::::

Related information, measures and tools

No	URL	タグ
1	http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-June/019076.html
2	http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-June/019076.html
3	http://marc.info/?l=bugtraq&m=134496371727681&w=2
4	http://marc.info/?l=bugtraq&m=134496371727681&w=2
5	http://marc.info/?l=bugtraq&m=134496371727681&w=2
6	http://marc.info/?l=bugtraq&m=134496371727681&w=2
7	http://rhn.redhat.com/errata/RHSA-2012-0734.html
8	http://rhn.redhat.com/errata/RHSA-2012-0734.html
9	http://security.gentoo.org/glsa/glsa-201406-32.xml
10	http://security.gentoo.org/glsa/glsa-201406-32.xml
11	http://www.mandriva.com/security/advisories?name=MDVSA-2012:095
12	http://www.mandriva.com/security/advisories?name=MDVSA-2012:095
13	http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
14	http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
15	http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
16	http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
17	http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html	Vendor Advisory
18	http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html	Vendor Advisory
19	http://www.securityfocus.com/bid/53958
20	http://www.securityfocus.com/bid/53958
21	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16659
22	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16659

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jre::update4::::::*		1.7.0
cpe:2.3:a:oracle:jre:1.7.0:update3::::::
cpe:2.3:a:oracle:jdk:1.7.0:update2::::::
cpe:2.3:a:oracle:jdk:1.7.0:::::::*
cpe:2.3:a:oracle:jdk::update4::::::*		1.7.0
cpe:2.3:a:oracle:jre:1.7.0:update2::::::
cpe:2.3:a:oracle:jdk:1.7.0:update3::::::
cpe:2.3:a:oracle:jre:1.7.0:::::::*
cpe:2.3:a:oracle:jdk:1.7.0:update1::::::
cpe:2.3:a:oracle:jre:1.7.0:update1::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:sun:jdk:1.6.0:update_4::::::
cpe:2.3:a:sun:jre:1.6.0:update_3::::::
cpe:2.3:a:sun:jre:1.6.0:update_5::::::
cpe:2.3:a:sun:jdk:1.6.0:update_7::::::
cpe:2.3:a:sun:jdk:1.6.0:update_19::::::
cpe:2.3:a:sun:jdk:1.6.0:update_13::::::
cpe:2.3:a:sun:jre:1.6.0:update_13::::::
cpe:2.3:a:sun:jre:1.6.0:update_1::::::
cpe:2.3:a:sun:jre:1.6.0:update_2::::::
cpe:2.3:a:sun:jdk:1.6.0:update_3::::::
cpe:2.3:a:sun:jre:1.6.0:update_16::::::
cpe:2.3:a:sun:jdk:1.6.0:update_11::::::
cpe:2.3:a:sun:jre:1.6.0:update_20::::::
cpe:2.3:a:sun:jdk:1.6.0:update_10::::::
cpe:2.3:a:sun:jre:1.6.0:update_15::::::
cpe:2.3:a:sun:jre:1.6.0:update_6::::::
cpe:2.3:a:sun:jdk:1.6.0:update_14::::::
cpe:2.3:a:sun:jdk:1.6.0:::::::*
cpe:2.3:a:sun:jdk:1.6.0:update_17::::::
cpe:2.3:a:sun:jre:1.6.0:update_19::::::
cpe:2.3:a:sun:jre:1.6.0:::::::*
cpe:2.3:a:sun:jdk:1.6.0:update_5::::::
cpe:2.3:a:sun:jre:1.6.0:update_18::::::
cpe:2.3:a:sun:jdk:1.6.0:update2::::::
cpe:2.3:a:sun:jdk:1.6.0:update_20:x64:::::*
cpe:2.3:a:sun:jre:1.6.0:update_10::::::
cpe:2.3:a:sun:jdk:1.6.0:update1_b06::::::
cpe:2.3:a:sun:jdk:1.6.0:update_21::::::
cpe:2.3:a:sun:jdk:1.6.0:update_16::::::
cpe:2.3:a:sun:jdk:1.6.0:update1::::::
cpe:2.3:a:sun:jre:1.6.0:update_17::::::
cpe:2.3:a:sun:jre:1.6.0:update_21::::::
cpe:2.3:a:sun:jre:1.6.0:update_7::::::
cpe:2.3:a:sun:jre:1.6.0:update_14::::::
cpe:2.3:a:sun:jdk:1.6.0:update_15::::::
cpe:2.3:a:sun:jdk:1.6.0:update_12::::::
cpe:2.3:a:sun:jre:1.6.0:update_4::::::
cpe:2.3:a:sun:jdk:1.6.0:update_18::::::
cpe:2.3:a:sun:jdk:1.6.0:update_6::::::
cpe:2.3:a:sun:jdk:1.6.0:update_20::::::
cpe:2.3:a:sun:jre:1.6.0:update_12::::::
cpe:2.3:a:sun:jre:1.6.0:update_11::::::
cpe:2.3:a:oracle:jdk:1.6.0:update25::::::
cpe:2.3:a:oracle:jdk:1.6.0:update29::::::
cpe:2.3:a:oracle:jdk:1.6.0:update31::::::
cpe:2.3:a:oracle:jdk:1.6.0:update27::::::
cpe:2.3:a:oracle:jdk:1.6.0:update24::::::
cpe:2.3:a:oracle:jdk:1.6.0:update23::::::
cpe:2.3:a:oracle:jdk:1.6.0:update22::::::
cpe:2.3:a:oracle:jdk:1.6.0:update26::::::
cpe:2.3:a:oracle:jdk:1.6.0:update30::::::
cpe:2.3:a:oracle:jdk::update32::::::*		1.6.0
cpe:2.3:a:oracle:jre:1.6.0:update30::::::
cpe:2.3:a:oracle:jre:1.6.0:update25::::::
cpe:2.3:a:oracle:jre:1.6.0:update24::::::
cpe:2.3:a:oracle:jre:1.6.0:update26::::::
cpe:2.3:a:oracle:jre::update32::::::*		1.6.0
cpe:2.3:a:oracle:jre:1.6.0:update27::::::
cpe:2.3:a:oracle:jre:1.6.0:update22::::::
cpe:2.3:a:oracle:jre:1.6.0:update31::::::
cpe:2.3:a:oracle:jre:1.6.0:update23::::::
cpe:2.3:a:oracle:jre:1.6.0:update29::::::