Oracle · Java Runtime Environment (JRE)
CVE-2010-0840
Oracle JRE Unspecified Vulnerability
Was es ist
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
CISA: Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.
Was zu tun ist
Apply updates per vendor instructions.
Frist für US-Bundesbehörden: 15. Juni 2022
- Zur CISA-Liste hinzugefügt
- 25. Mai 2022
- Veröffentlicht
- 1. April 2010
- Schweregrad
- Kritisch 9,8 CVSS 3.1
- Wahrscheinlichkeit von Angriffen in den nächsten 30 Tagen (EPSS)
- 96% unter den obersten 0,1% aller bekannten Schwachstellen
- Mehr Details
- NVD · CVE.org · CISA
Alle Quellen (20)
- http://lists.apple.com/archives/security-announce/2010//May/msg00001.html
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://www.redhat.com/support/errata/RHSA-2010-0383.html
- http://www.redhat.com/support/errata/RHSA-2010-0338.html
- http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751
- http://marc.info/?l=bugtraq&m=127557596201693&w=2
- http://www.redhat.com/support/errata/RHSA-2010-0339.html
- http://www.securityfocus.com/archive/1/510528/100/0/threaded
- http://secunia.com/advisories/39317
- http://secunia.com/advisories/40545
- http://www.vupen.com/english/advisories/2010/1454
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13971
- http://secunia.com/advisories/39819
- http://www.vupen.com/english/advisories/2010/1107
- http://www.vupen.com/english/advisories/2010/1793
- http://secunia.com/advisories/43308
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
- http://www.oracle.com/technetwork/topics/security/javacpumar2010-083341.html
Weitere ausgenutzte Schwachstellen von Oracle
| Hinzugefügt | Schwachstelle | Produkt | Schweregrad | Angriffswahrscheinlichkeit |
|---|---|---|---|---|
| 25.05.2022 | JRE Remote Code Execution | Java Runtime Environment (JRE) | Kritisch 9,8 | 97% |
| 25.05.2022 | JRE Sandbox Bypass | Java Runtime Environment (JRE) | Niedrig 3,7 | 90% |
| 25.05.2022 | JRE Unspecified | Java Runtime Environment (JRE) | Niedrig 3,7 | 85% |
| 24.08.2026 | Improper Access Control | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Kritisch 10,0 | 73% |
| 15.07.2026 | Improper Privilege Management | E-Business Suite | Kritisch 9,8 | 12% |
| 12.06.2026 | PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function | PeopleSoft Enterprise PeopleTools | Kritisch 9,8 | 97% |
| 01.06.2026 | Unspecified | WebLogic Server | Hoch 7,5 | 74% |
| 21.11.2025 | Missing Authentication for Critical Function | Fusion Middleware | Kritisch 9,8 | 89% |
Quellen: Known Exploited Vulnerabilities (CISA, gemeinfrei), CVE records (cve.org) und EPSS (FIRST). Die Angriffswahrscheinlichkeit ist die EPSS-Schätzung, dass jemand in den nächsten 30 Tagen versucht, die Schwachstelle auszunutzen.