CVE-2012-4420 — java-1.7.0-openjdk: JVM heap memory disclosure

Back Back to CVE browser

HIGH

java-1.7.0-openjdk: JVM heap memory disclosure

Published Dec 26, 2019

7.5

HIGH

CVSS 3.1

EPSS 4.51%

Description

An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.

Affected products

Vendor Java-1.7.0-Openjdk Product Java-1.7.0-Openjdk Default
n/a
- Version
  1.7.0_04 to 1.7.0_10
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Java-1.7.0-Openjdk

n/a

Version	Status	Constraints
1.7.0_04 to 1.7.0_10	affected	-

Red Hat Enterprise Linux 5

java-1.4.2-ibm

Not affected
Red Hat Enterprise Linux 5

java-1.4.2-ibm-sap

Not affected
Red Hat Enterprise Linux 5

java-1.5.0-ibm

Not affected
Red Hat Enterprise Linux 5

java-1.6.0-ibm

Not affected
Red Hat Enterprise Linux 5

java-1.6.0-openjdk

Not affected
Red Hat Enterprise Linux 5

java-1.6.0-sun

Not affected
Red Hat Enterprise Linux 6

java-1.4.2-ibm-sap

Not affected
Red Hat Enterprise Linux 6

java-1.5.0-ibm

Not affected
Red Hat Enterprise Linux 6

java-1.6.0-ibm

Not affected
Red Hat Enterprise Linux 6

java-1.6.0-openjdk

Not affected
Red Hat Enterprise Linux 6

java-1.6.0-sun

Not affected
Red Hat Enterprise Linux 6

java-1.7.0-ibm

Not affected
Red Hat Enterprise Linux 6

java-1.7.0-openjdk

Not affected
Red Hat Enterprise Linux 6

java-1.7.0-oracle

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	java-1.4.2-ibm	Not affected	n/a
Red Hat Enterprise Linux 5	java-1.4.2-ibm-sap	Not affected	n/a
Red Hat Enterprise Linux 5	java-1.5.0-ibm	Not affected	n/a
Red Hat Enterprise Linux 5	java-1.6.0-ibm	Not affected	n/a
Red Hat Enterprise Linux 5	java-1.6.0-openjdk	Not affected	n/a
Red Hat Enterprise Linux 5	java-1.6.0-sun	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.4.2-ibm-sap	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.5.0-ibm	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.6.0-ibm	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.6.0-openjdk	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.6.0-sun	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.7.0-ibm	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.7.0-openjdk	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.7.0-oracle	Not affected	n/a

Remediation

Red Hat statement

This flaw was found to be a duplicate of CVE-2012-4416. Please see https://access.redhat.com/security/cve/CVE-2012-4416 for information about affected products and security errata.

Metrics

4.51% 0.04512

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.04512

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	4.51% (0.04512)	91.22th	v5 (v2026.06.15)
Jun 15, 2026	4.51% (0.04512)	90.26th	v5 (v2026.06.15)
Mar 17, 2025	1.01% (0.01010)	75.54th	v4 (v2025.03.14)
Dec 12, 2024	0.80% (0.00801)	82.37th	v3 (v2023.03.01)
May 23, 2024	0.80% (0.00801)	81.65th	v3 (v2023.03.01)
Feb 20, 2024	0.84% (0.00841)	81.59th	v3 (v2023.03.01)
Mar 7, 2023	0.88% (0.00875)	79.95th	v3 (v2023.03.01)
Mar 6, 2023	1.32% (0.01319)	71.27th	v2 (v2022.01.01)
Feb 23, 2023	1.32% (0.01319)	71.23th	v2 (v2022.01.01)
Apr 1, 2022	1.32% (0.01319)	69.22th	v2 (v2022.01.01)
Feb 4, 2022	1.32% (0.01319)	44.98th	v2 (v2022.01.01)

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (11)

http://www.openwall.com/lists/oss-security/2012/09/13/3
x_refsource_MISCMailing ListThird Party Advisory
http://www.securityfocus.com/bid/55538
x_refsource_MISCThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2012-4420
Vendor Advisory
https://access.redhat.com/security/cve/cve-2012-4420
x_refsource_MISCThird Party Advisory
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7196857
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=856588
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4420
x_refsource_MISCIssue TrackingThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78693
x_refsource_MISCThird Party AdvisoryVDB Entry
https://nvd.nist.gov/vuln/detail/CVE-2012-4420
https://www.cve.org/CVERecord?id=CVE-2012-4420
https://www.openwall.com/lists/oss-security/2012/09/12/4
x_refsource_MISCMailing ListThird Party Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2012/09/13/3		x_refsource_MISCMailing ListThird Party Advisory
http://www.securityfocus.com/bid/55538		x_refsource_MISCThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2012-4420		Vendor Advisory
https://access.redhat.com/security/cve/cve-2012-4420		x_refsource_MISCThird Party Advisory
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7196857		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=856588		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4420		x_refsource_MISCIssue TrackingThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78693		x_refsource_MISCThird Party AdvisoryVDB Entry
https://nvd.nist.gov/vuln/detail/CVE-2012-4420
https://www.cve.org/CVERecord?id=CVE-2012-4420
https://www.openwall.com/lists/oss-security/2012/09/12/4		x_refsource_MISCMailing ListThird Party Advisory