Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2010-0840

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

Published

2010-04-01T16:30:00.907

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application oracle jre 1.4.2_25 Yes
Application oracle jre 1.5.0 Yes
Application oracle jre 1.6.0 Yes
Operating System opensuse opensuse 11.0 Yes
Operating System opensuse opensuse 11.1 Yes
Operating System opensuse opensuse 11.2 Yes
Operating System canonical ubuntu_linux 8.04 Yes
Operating System canonical ubuntu_linux 8.10 Yes
Operating System canonical ubuntu_linux 9.04 Yes
Operating System canonical ubuntu_linux 9.10 Yes
References