CVEs / CVE-2010-0840
CVE-2010-0840: Oracle JRE Unspecified Vulnerability
- Known exploited in the CISA KEV catalog since 25 May 2022
- critical 9.8 CVSS 3.1 (NVD)
- EPSS 96.3% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2010-0840
Summary
Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.
Description
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 25 May 2022 |
|---|---|
| Due date for US federal agencies | 15 Jun 2022 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 3.1 | 9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|
References
- CVE-2010-0840 on NVD
- CVE-2010-0840 in the CISA KEV catalog
- http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 Broken Link
- http://lists.apple.com/archives/security-announce/2010//May/msg00001.html Mailing List, Third Party Advisory
- http://lists.apple.com/archives/security-announce/2010//May/msg00002.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=127557596201693&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=134254866602253&w=2 Mailing List
- http://secunia.com/advisories/39292 Broken Link, Vendor Advisory
- http://secunia.com/advisories/39317 Broken Link, Vendor Advisory
- http://secunia.com/advisories/39659 Broken Link, Vendor Advisory
- http://secunia.com/advisories/39819 Broken Link, Vendor Advisory
- http://secunia.com/advisories/40211 Broken Link, Vendor Advisory
- http://secunia.com/advisories/40545 Broken Link, Vendor Advisory
- http://secunia.com/advisories/43308 Broken Link, Vendor Advisory
- http://support.apple.com/kb/HT4170 Release Notes, Third Party Advisory
- http://support.apple.com/kb/HT4171 Release Notes, Third Party Advisory
- http://ubuntu.com/usn/usn-923-1 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:084 Broken Link
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html Patch, Third Party Advisory
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.