CVE-2010-0840

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 96,3%

Kerentanan pada oracle jre, opensuse +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 Mei 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

Rincian

Terbit di NVD

1 April 2010

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

96,3% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Oracle JRE Unspecified Vulnerability

Masuk KEV

25 Mei 2022

Tenggat CISA

15 Juni 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://secunia.com/advisories/39292 broken link · advisory vendor
• http://secunia.com/advisories/39317 broken link · advisory vendor
• http://secunia.com/advisories/39659 broken link · advisory vendor
• http://secunia.com/advisories/39819 broken link · advisory vendor
• http://secunia.com/advisories/40211 broken link · advisory vendor
• http://secunia.com/advisories/40545 broken link · advisory vendor
• http://secunia.com/advisories/43308 broken link · advisory vendor
• http://www.vupen.com/english/advisories/2010/1191 broken link · advisory vendor
• http://www.vupen.com/english/advisories/2010/1454 broken link · advisory vendor
• http://www.vupen.com/english/advisories/2010/1523 broken link · advisory vendor
• http://www.vupen.com/english/advisories/2010/1793 broken link · advisory vendor
• http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html patch · advisory pihak ketiga
• http://www.oracle.com/technetwork/topics/security/javacpumar2010-083341.html patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0840 pemerintah AS
• http://lists.apple.com/archives/security-announce/2010//May/msg00001.html mailing list · advisory pihak ketiga
• http://lists.apple.com/archives/security-announce/2010//May/msg00002.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html mailing list · advisory pihak ketiga
• http://support.apple.com/kb/HT4170 release notes · advisory pihak ketiga
• http://support.apple.com/kb/HT4171 release notes · advisory pihak ketiga
• http://ubuntu.com/usn/usn-923-1 advisory pihak ketiga
• http://www.securityfocus.com/archive/1/510528/100/0/threaded broken link · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/archive/1/516397/100/0/threaded broken link · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/39065 broken link · advisory pihak ketiga · vdb entry