cvelistv5 - cve-2012-4820

CVE-2012-4820 (GCVE-0-2012-4820)

Vulnerability from cvelistv5

Published

2013-01-11 00:00

Modified

2024-08-06 20:50

Severity ?

CWE

Summary

Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to "insecure use of the java.lang.reflect.Method invoke() method."

References

URL

Tags

	http://rhn.redhat.com/errata/RHSA-2012-1466.html	vendor-advisory, x_refsource_REDHAT
	http://www-01.ibm.com/support/docview.wss?uid=swg21616616	x_refsource_CONFIRM
	http://www-01.ibm.com/support/docview.wss?uid=swg21616594	x_refsource_CONFIRM
	http://www-01.ibm.com/support/docview.wss?uid=swg21616617	x_refsource_CONFIRM
	http://www-01.ibm.com/support/docview.wss?uid=swg21621154	x_refsource_CONFIRM
	http://seclists.org/bugtraq/2012/Sep/38	mailing-list, x_refsource_BUGTRAQ
	http://www-01.ibm.com/support/docview.wss?uid=swg21616652	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2013-1455.html	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/55495	vdb-entry, x_refsource_BID
	http://www-01.ibm.com/support/docview.wss?uid=swg21631786	x_refsource_CONFIRM
	http://www-01.ibm.com/support/docview.wss?uid=swg21615800	x_refsource_CONFIRM
	http://www-01.ibm.com/support/docview.wss?uid=swg21616490	x_refsource_CONFIRM
	http://secunia.com/advisories/51327	third-party-advisory, x_refsource_SECUNIA
	https://www-304.ibm.com/support/docview.wss?uid=swg21616546	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/78764	vdb-entry, x_refsource_XF
	http://rhn.redhat.com/errata/RHSA-2012-1467.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2012-1465.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/51328	third-party-advisory, x_refsource_SECUNIA
	http://www-01.ibm.com/support/docview.wss?uid=swg21616708	x_refsource_CONFIRM
	http://secunia.com/advisories/51634	third-party-advisory, x_refsource_SECUNIA
	http://www-01.ibm.com/support/docview.wss?uid=swg1IV29654	vendor-advisory, x_refsource_AIXAPAR
	http://www-01.ibm.com/support/docview.wss?uid=swg21615705	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2013-1456.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/51393	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/51326	third-party-advisory, x_refsource_SECUNIA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:50:17.367Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2012:1466",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1466.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616616"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616594"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616617"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21621154"
          },
          {
            "name": "20120911 [SE-2012-01] Security vulnerabilities in IBM Java",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://seclists.org/bugtraq/2012/Sep/38"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616652"
          },
          {
            "name": "RHSA-2013:1455",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html"
          },
          {
            "name": "55495",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/55495"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21631786"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21615800"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616490"
          },
          {
            "name": "51327",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51327"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21616546"
          },
          {
            "name": "ibm-java-invoke-code-execution(78764)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78764"
          },
          {
            "name": "RHSA-2012:1467",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1467.html"
          },
          {
            "name": "RHSA-2012:1465",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1465.html"
          },
          {
            "name": "51328",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51328"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616708"
          },
          {
            "name": "51634",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51634"
          },
          {
            "name": "IV29654",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV29654"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21615705"
          },
          {
            "name": "RHSA-2013:1456",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html"
          },
          {
            "name": "51393",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51393"
          },
          {
            "name": "51326",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51326"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-09-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes \u0026 Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to \"insecure use of the java.lang.reflect.Method invoke() method.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "RHSA-2012:1466",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1466.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616616"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616594"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616617"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21621154"
        },
        {
          "name": "20120911 [SE-2012-01] Security vulnerabilities in IBM Java",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://seclists.org/bugtraq/2012/Sep/38"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616652"
        },
        {
          "name": "RHSA-2013:1455",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html"
        },
        {
          "name": "55495",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/55495"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21631786"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21615800"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616490"
        },
        {
          "name": "51327",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51327"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21616546"
        },
        {
          "name": "ibm-java-invoke-code-execution(78764)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78764"
        },
        {
          "name": "RHSA-2012:1467",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1467.html"
        },
        {
          "name": "RHSA-2012:1465",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1465.html"
        },
        {
          "name": "51328",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51328"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616708"
        },
        {
          "name": "51634",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51634"
        },
        {
          "name": "IV29654",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV29654"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21615705"
        },
        {
          "name": "RHSA-2013:1456",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html"
        },
        {
          "name": "51393",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51393"
        },
        {
          "name": "51326",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51326"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2012-4820",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes \u0026 Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to \"insecure use of the java.lang.reflect.Method invoke() method.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2012:1466",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2012-1466.html"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21616616",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616616"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21616594",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616594"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21616617",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616617"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21621154",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21621154"
            },
            {
              "name": "20120911 [SE-2012-01] Security vulnerabilities in IBM Java",
              "refsource": "BUGTRAQ",
              "url": "http://seclists.org/bugtraq/2012/Sep/38"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21616652",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616652"
            },
            {
              "name": "RHSA-2013:1455",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html"
            },
            {
              "name": "55495",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/55495"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21631786",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21631786"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21615800",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21615800"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21616490",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616490"
            },
            {
              "name": "51327",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/51327"
            },
            {
              "name": "https://www-304.ibm.com/support/docview.wss?uid=swg21616546",
              "refsource": "CONFIRM",
              "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21616546"
            },
            {
              "name": "ibm-java-invoke-code-execution(78764)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78764"
            },
            {
              "name": "RHSA-2012:1467",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2012-1467.html"
            },
            {
              "name": "RHSA-2012:1465",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2012-1465.html"
            },
            {
              "name": "51328",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/51328"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21616708",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616708"
            },
            {
              "name": "51634",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/51634"
            },
            {
              "name": "IV29654",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV29654"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21615705",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21615705"
            },
            {
              "name": "RHSA-2013:1456",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html"
            },
            {
              "name": "51393",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/51393"
            },
            {
              "name": "51326",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/51326"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2012-4820",
    "datePublished": "2013-01-11T00:00:00.000Z",
    "dateReserved": "2012-09-06T00:00:00.000Z",
    "dateUpdated": "2024-08-06T20:50:17.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2012-AVI-757

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans IBM Tivoli. Elles concernent le contournement de politiques de sécurités des modules JAVA pouvant mener un utilisateur malintentionné à exécuter du code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	IBM	Tivoli	IBM Tivoli Endpoint Manager version 8.2
	IBM	Tivoli	IBM Tivoli Remote Control version 5.1.2

References

Title

Publication Time

Tags

Bulletin de sécurité IBM swg21616594 du 19 décembre 2012	None	vendor-advisory
Bulletin de sécurité IBM swg21616584 du 19 décembre 2012	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Tivoli Endpoint Manager version 8.2",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Tivoli Remote Control version 5.1.2",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-4823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4823"
    },
    {
      "name": "CVE-2012-4820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4820"
    },
    {
      "name": "CVE-2012-4821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4821"
    },
    {
      "name": "CVE-2012-4822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4822"
    }
  ],
  "initial_release_date": "2012-12-21T00:00:00",
  "last_revision_date": "2012-12-21T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-757",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-12-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eIBM Tivoli\u003c/span\u003e. Elles concernent le contournement de\npolitiques de s\u00e9curit\u00e9s des modules JAVA pouvant mener un utilisateur\nmalintentionn\u00e9 \u00e0 ex\u00e9cuter du code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21616594 du 19 d\u00e9cembre 2012",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616594"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21616584 du 19 d\u00e9cembre 2012",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616584"
    }
  ]
}

CERTA-2012-AVI-657

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans IBM Tivoli Management Framework. Certaines d'entre elles permettent à un attaquant d'exécuter du code arbitraire à distance et de contourner la politique de sécurité de la "sandbox" au moyen de fichiers .jar spécialement conçus.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

IBM Tivoli Management Framework version 4.3.1

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité IBM swg21616558 du 15 novembre 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eIBM Tivoli Management Framework version 4.3.1\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-4823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4823"
    },
    {
      "name": "CVE-2012-4820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4820"
    },
    {
      "name": "CVE-2012-4821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4821"
    },
    {
      "name": "CVE-2012-4822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4822"
    }
  ],
  "initial_release_date": "2012-11-16T00:00:00",
  "last_revision_date": "2012-11-16T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-657",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-11-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eIBM Tivoli Management Framework\u003c/span\u003e. Certaines d\u0027entre\nelles permettent \u00e0 un attaquant d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance\net de contourner la politique de s\u00e9curit\u00e9 de la \"sandbox\" au moyen de\nfichiers \u003cspan class=\"textit\"\u003e.jar\u003c/span\u003e sp\u00e9cialement con\u00e7us.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli Management Framework",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21616558 du 15 novembre 2012",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616558"
    }
  ]
}

CERTA-2012-AVI-655

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans IBM Java SDK. Certaines d'entre elles permettent à un attaquant d'exécuter du code arbitraire à distance et de contourner la politique de sécurité de la "sandbox" au moyen de fichiers .jar spécialement conçus.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
IBM	N/A	IBM Java SDK versions antérieures à 6.01 SR4
IBM	N/A	IBM Java SDK versions antérieures à 5 SR15
IBM	N/A	IBM Java SDK versions antérieures à 1.4.2 SR13-FP14
IBM	N/A	IBM Java SDK versions antérieures à 6 SR12
IBM	N/A	IBM Java SDK versions antérieures à 7 SR3

References

Title

Publication Time

Tags

Bulletin de sécurité IBM swg21616617 du 13 novembre 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Java SDK versions ant\u00e9rieures \u00e0 6.01 SR4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Java SDK versions ant\u00e9rieures \u00e0 5 SR15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Java SDK versions ant\u00e9rieures \u00e0 1.4.2 SR13-FP14",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Java SDK versions ant\u00e9rieures \u00e0 6 SR12",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Java SDK versions ant\u00e9rieures \u00e0 7 SR3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-4823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4823"
    },
    {
      "name": "CVE-2012-4820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4820"
    },
    {
      "name": "CVE-2012-4821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4821"
    },
    {
      "name": "CVE-2012-4822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4822"
    }
  ],
  "initial_release_date": "2012-11-15T00:00:00",
  "last_revision_date": "2012-11-15T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-655",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-11-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eIBM Java SDK\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0\nun attaquant d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance et de contourner\nla politique de s\u00e9curit\u00e9 de la \"sandbox\" au moyen de fichiers \u003cspan\nclass=\"textit\"\u003e.jar\u003c/span\u003e sp\u00e9cialement con\u00e7us.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Java SDK",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21616617 du 13 novembre 2012",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616617"
    }
  ]
}

CERTA-2012-AVI-656

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans IBM Lotus Notes et Domino. Certaines d'entre elles permettent à un attaquant d'exécuter du code arbitraire à distance et de contourner la politique de sécurité de la "sandbox" au moyen de fichiers .jar spécialement conçus.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

IBM Lotus Notes et Domino versions antérieures à 8.5.3 Fix Pack 2

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité IBM swg21616652 du 15 novembre 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eIBM Lotus Notes et Domino versions ant\u00e9rieures \u00e0 8.5.3 Fix  Pack 2\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-4823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4823"
    },
    {
      "name": "CVE-2012-4820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4820"
    },
    {
      "name": "CVE-2012-4821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4821"
    },
    {
      "name": "CVE-2012-4822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4822"
    }
  ],
  "initial_release_date": "2012-11-16T00:00:00",
  "last_revision_date": "2012-11-16T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-656",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-11-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eIBM Lotus Notes et Domino\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance et de\ncontourner la politique de s\u00e9curit\u00e9 de la \"sandbox\" au moyen de fichiers\n\u003cspan class=\"textit\"\u003e.jar\u003c/span\u003e sp\u00e9cialement con\u00e7us.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Lotus Notes et Domino",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21616652 du 15 novembre 2012",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616652"
    }
  ]
}

CERTA-2012-AVI-658

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans IBM Tivoli Monitoring. Certaines d'entre elles permettent à un attaquant d'exécuter du code arbitraire à distance et de contourner la politique de sécurité de la "sandbox" au moyen de fichiers .jar spécialement conçus.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
IBM	Tivoli Monitoring	IBM Tivoli Monitoring de la version 6.2.2 à la version 6.2.2 Fix Pack 09
IBM	Tivoli Monitoring	IBM Tivoli Monitoring de la version 6.2.0 à la version 6.2.0 Fix Pack 03
IBM	Tivoli Monitoring	IBM Tivoli Monitoring de la version 6.2.3 à la version 6.2.3 Fix Pack 02
IBM	Tivoli Monitoring	IBM Tivoli Monitoring de la version 6.2.1 à la version 6.2.1 Fix Pack 04

References

Title

Publication Time

Tags

Bulletin de sécurité IBM swg21616490 du 15 novembre 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Tivoli Monitoring de la version 6.2.2 \u00e0 la version 6.2.2 Fix Pack 09",
      "product": {
        "name": "Tivoli Monitoring",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Tivoli Monitoring de la version 6.2.0 \u00e0 la version 6.2.0 Fix Pack 03",
      "product": {
        "name": "Tivoli Monitoring",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Tivoli Monitoring de la version 6.2.3 \u00e0 la version 6.2.3 Fix Pack 02",
      "product": {
        "name": "Tivoli Monitoring",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Tivoli Monitoring de la version 6.2.1 \u00e0 la version 6.2.1 Fix Pack 04",
      "product": {
        "name": "Tivoli Monitoring",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-4823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4823"
    },
    {
      "name": "CVE-2012-4820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4820"
    },
    {
      "name": "CVE-2012-4821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4821"
    },
    {
      "name": "CVE-2012-4822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4822"
    }
  ],
  "initial_release_date": "2012-11-16T00:00:00",
  "last_revision_date": "2012-11-16T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-658",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-11-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eIBM Tivoli Monitoring\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance et de\ncontourner la politique de s\u00e9curit\u00e9 de la \"sandbox\" au moyen de fichiers\n\u003cspan class=\"textit\"\u003e.jar\u003c/span\u003e sp\u00e9cialement con\u00e7us.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli Monitoring",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21616490 du 15 novembre 2012",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24033800"
    }
  ]
}

CERTA-2012-AVI-716

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans IBM WebSphere Application Server. Elles permettent à un attaquant de contourner la politique de sécurité. Elles concernent le composant Java.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
IBM	WebSphere	IBM WebSphere Application Server de la version 8.5.0.0 à la version 8.5.0.1
IBM	WebSphere	IBM WebSphere Application Server de la version 8.0.0.0 à la version 8.0.0.5
IBM	WebSphere	IBM WebSphere Application Server de la version 7.0.0.0 à la version 7.0.0.25
IBM	WebSphere	IBM WebSphere Application Server de la version 6.1.0.0 à la version 6.1.0.45

References

Title

Publication Time

Tags

Bulletin de sécurité IBM swg21617227 du 04 decembre 2012	None	vendor-advisory
Bulletin de sécurité IBM swg21617227 du 04 décembre 2012 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM WebSphere Application Server de la version 8.5.0.0 \u00e0 la version 8.5.0.1",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM WebSphere Application Server de la version 8.0.0.0 \u00e0 la version 8.0.0.5",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM WebSphere Application Server de la version 7.0.0.0 \u00e0 la version 7.0.0.25",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM WebSphere Application Server de la version 6.1.0.0 \u00e0 la version 6.1.0.45",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-4823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4823"
    },
    {
      "name": "CVE-2012-4820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4820"
    },
    {
      "name": "CVE-2012-4821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4821"
    },
    {
      "name": "CVE-2012-4822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4822"
    }
  ],
  "initial_release_date": "2012-12-11T00:00:00",
  "last_revision_date": "2012-12-11T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21617227 du 04 d\u00e9cembre 2012 :",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21617227"
    }
  ],
  "reference": "CERTA-2012-AVI-716",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-12-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eIBM WebSphere Application Server\u003c/span\u003e. Elles permettent\n\u00e0 un attaquant de contourner la politique de s\u00e9curit\u00e9. Elles concernent\nle composant \u003cspan class=\"textit\"\u003eJava\u003c/span\u003e.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM WebSphere Application Server",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21617227 du 04 decembre 2012",
      "url": null
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2012-4820 (GCVE-0-2012-4820)

Vulnerability from cvelistv5

CERTA-2012-AVI-757

Vulnerability from certfr_avis

Solution

CERTA-2012-AVI-657

Vulnerability from certfr_avis

Solution

CERTA-2012-AVI-655

Vulnerability from certfr_avis

Solution

CERTA-2012-AVI-656

Vulnerability from certfr_avis

Solution

CERTA-2012-AVI-658

Vulnerability from certfr_avis

Solution

CERTA-2012-AVI-716

Vulnerability from certfr_avis

Solution

Tags

Sightings

Nomenclature