CVE-2012-4420

An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.

• CWE-200

• http://www.openwall.com/lists/oss-security/2012/09/13/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/55538Third Party Advisory, VDB Entry
• https://access.redhat.com/security/cve/cve-2012-4420Third Party Advisory
• https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7196857Exploit, Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4420Issue Tracking, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78693Third Party Advisory, VDB Entry
• https://www.openwall.com/lists/oss-security/2012/09/12/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/09/13/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/55538Third Party Advisory, VDB Entry
• https://access.redhat.com/security/cve/cve-2012-4420Third Party Advisory
• https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7196857Exploit, Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4420Issue Tracking, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78693Third Party Advisory, VDB Entry
• https://www.openwall.com/lists/oss-security/2012/09/12/4Mailing List, Third Party Advisory

Published

Dec 26, 2019

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4414Multiple SQL injection vulnerabilities in the replication co…
• CVE-2012-4415Stack-based buffer overflow in the guac_client_plugin_open f…
• CVE-2012-4416Unspecified vulnerability in the Java Runtime Environment (J…
• CVE-2012-4417GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allo…
• CVE-2012-4418Apache Axis2 allows remote attackers to forge messages and b…
• CVE-2012-4419The compare_tor_addr_to_addr_policy function in or/policies.…
• CVE-2012-4421The create_post function in wp-includes/class-wp-atom-server…
• CVE-2012-4422wp-admin/plugins.php in WordPress before 3.4.2, when the mul…
• CVE-2012-4423The virNetServerProgramDispatchCall function in libvirt befo…
• CVE-2012-4424Stack-based buffer overflow in string/strcoll_l.c in the GNU…
• CVE-2012-4425libgio, when used in setuid or other privileged programs in …
• CVE-2012-4426Multiple format string vulnerabilities in mcrypt 2.6.8 and e…