Vulnerability in Oracle Jre
CVE-2010-0840
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
EPSS: 0.963 (99.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Oracle Jre — versions 1.4.2_25, 1.5.0, 1.6.0
- Canonical Ubuntu_linux — versions 8.04, 8.10, 9.04
- Opensuse — versions 11.0, 11.1, 11.2
- N/a — versions n/a
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- secalert_us@oracle.com (vendor-advisory, x_refsource_APPLE, Mailing List, Third Party Advisory)
- secalert_us@oracle.com (x_refsource_HP, vendor-advisory, Mailing List)
- secalert_us@oracle.com (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory, Broken Link)
- secalert_us@oracle.com (x_refsource_SECUNIA, Broken Link, Vendor Advisory, third-party-advisory)
- secalert_us@oracle.com (x_refsource_REDHAT, vendor-advisory, Broken Link)
- secalert_us@oracle.com (x_refsource_SECUNIA, Broken Link, Vendor Advisory, third-party-advisory)
- secalert_us@oracle.com (vdb-entry, Broken Link, x_refsource_VUPEN, Vendor Advisory)
- secalert_us@oracle.com (Broken Link, signature, x_refsource_OVAL, vdb-entry)
- secalert_us@oracle.com (x_refsource_SECUNIA, Broken Link, Vendor Advisory, third-party-advisory)
- secalert_us@oracle.com (vdb-entry, Broken Link, x_refsource_VUPEN)
Frequently asked questions
- What is CVE-2010-0840?
- CVE-2010-0840 is a critical-severity vulnerability in Oracle Jre. CVSS score: 9.8/10. Published 2010-04-01.
- How severe is CVE-2010-0840?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2010-0840 known to be exploited?
- Yes. CVE-2010-0840 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-05-25), indicating it is being actively exploited. 5 public proof-of-concept repositories are indexed.