| Name | CVE-2012-2672 |
| Description | Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 677194 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| mojarra (PTS) | jessie | 2.2.8-1 | fixed |
| stretch | 2.2.8-3 | fixed |
| sid, buster, bullseye, trixie, bookworm | 2.2.8-6 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| mojarra | source | squeeze | (not affected) | | | |
| mojarra | source | wheezy | (not affected) | | | |
| mojarra | source | (unstable) | 2.2.8-1 | | | 677194 |
Notes
[wheezy] - mojarra <not-affected> (Only affected in combination with EAP6/AS7 application servers, not shipped in Debian)
[squeeze] - mojarra <not-affected> (Only affected in combination with EAP6/AS7 application servers, not shipped in Debian)