Oracle · Java Runtime Environment (JRE)
CVE-2010-0840
Oracle JRE Unspecified Vulnerability
Cos'è
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
CISA: Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 15 giugno 2022
- Aggiunta all'elenco CISA
- 25 maggio 2022
- Pubblicato
- 1 aprile 2010
- Gravità
- Critica 9,8 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 96% tra il 0,1% più alto di tutte le vulnerabilità note
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (20)
- http://lists.apple.com/archives/security-announce/2010//May/msg00001.html
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://www.redhat.com/support/errata/RHSA-2010-0383.html
- http://www.redhat.com/support/errata/RHSA-2010-0338.html
- http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751
- http://marc.info/?l=bugtraq&m=127557596201693&w=2
- http://www.redhat.com/support/errata/RHSA-2010-0339.html
- http://www.securityfocus.com/archive/1/510528/100/0/threaded
- http://secunia.com/advisories/39317
- http://secunia.com/advisories/40545
- http://www.vupen.com/english/advisories/2010/1454
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13971
- http://secunia.com/advisories/39819
- http://www.vupen.com/english/advisories/2010/1107
- http://www.vupen.com/english/advisories/2010/1793
- http://secunia.com/advisories/43308
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
- http://www.oracle.com/technetwork/topics/security/javacpumar2010-083341.html
Altre falle sfruttate di Oracle
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 25 mag 2022 | JRE Remote Code Execution | Java Runtime Environment (JRE) | Critica 9,8 | 97% |
| 25 mag 2022 | JRE Sandbox Bypass | Java Runtime Environment (JRE) | Bassa 3,7 | 90% |
| 25 mag 2022 | JRE Unspecified | Java Runtime Environment (JRE) | Bassa 3,7 | 85% |
| 24 ago 2026 | Improper Access Control | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Critica 10,0 | 73% |
| 15 lug 2026 | Improper Privilege Management | E-Business Suite | Critica 9,8 | 12% |
| 12 giu 2026 | PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function | PeopleSoft Enterprise PeopleTools | Critica 9,8 | 97% |
| 1 giu 2026 | Unspecified | WebLogic Server | Alta 7,5 | 74% |
| 21 nov 2025 | Missing Authentication for Critical Function | Fusion Middleware | Critica 9,8 | 89% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.