CVE-2010-3560

JDK unspecified vulnerability in Networking component

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality via unknown vectors.

CVSS 2.0 · 2.6 Low EPSS 2.7% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2010-3561

OpenJDK corba reflection vulnerabilities (6891766,6925672)

Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this involves the use of the privileged accept method in the ServerSocket class, which does not limit which hosts can connect and allows remote attackers to bypass intended network access restrictions.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Rhel Extras Jdk and 1 more

CVE-2010-3562

OpenJDK IndexColorModel double-free (6925710)

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a double free vulnerability in IndexColorModel that allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.

CVSS 2.0 · 10.0 Critical EPSS 7.1% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-3563

OpenJDK: unspecified vulnerability in Deployment component

Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to "how Web Start retrieves security policies," BasicServiceImpl, and forged policies that bypass sandbox restrictions.

CVSS 2.0 · 10.0 Critical EPSS 84.2% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2010-3565

OpenJDK JPEG writeImage remote code execution (6963023)

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that triggers memory corruption via large values in a subsample of a JPEG image, related to JPEGImageWriter.writeImage in the imageio API.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-3566

OpenJDK ICC Profile remote code execution (6963489)

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that leads to a buffer overflow via a crafted devs (device information) tag structure in a color profile.

CVSS 2.0 · 10.0 Critical EPSS 5.9% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2010-3567

OpenJDK ICU Opentype layout engine crash (6963285)

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to a calculation error in right-to-left text character counts for the ICU OpenType font rendering implementation, which triggers an out-of-bounds memory access.

CVSS 2.0 · 10.0 Critical EPSS 4.9% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Rhel Extras Jdk and 1 more

CVE-2010-3568

OpenJDK Deserialization Race condition (6559775)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a race condition related to deserialization.

CVSS 2.0 · 10.0 Critical EPSS 4.9% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-3569

OpenJDK Serialization inconsistencies (6966692)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to execute arbitrary code by causing the defaultReadObject method in the Serialization API to set a volatile field multiple times.

CVSS 2.0 · 10.0 Critical EPSS 7.1% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-3570

JDK unspecified vulnerability in Deployment Toolkit

Unspecified vulnerability in the Deployment Toolkit component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 7.6 High EPSS 3.9% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre

CVE-2010-3571

JDK unspecified vulnerability in 2D component

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the color profile parser that allows remote attackers to execute arbitrary code via a crafted Tag structure in a color profile.

CVSS 2.0 · 10.0 Critical EPSS 9.1% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 3 more

CVE-2010-3572

JDK unspecified vulnerability in Sound component

Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.2% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 3 more

CVE-2010-3573

OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004)

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.

CVSS 2.0 · 5.1 Medium EPSS 10.6% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2010-3574

OpenJDK HttpURLConnection incomplete TRACE permission check (6981426)

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.

CVSS 2.0 · 10.0 Critical EPSS 4.9% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 3 more

CVE-2010-4422

JDK unspecified vulnerability in Deployment component

Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 7.6 High EPSS 3.4% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2010-4447

JDK unspecified vulnerability in Deployment component

Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Deployment, a different vulnerability than CVE-2010-4475.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 3 more

CVE-2010-4448

OpenJDK DNS cache poisoning by untrusted applets (6981922)

Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to Networking. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue involves "DNS cache poisoning by untrusted applets."

CVSS 2.0 · 2.6 Low EPSS 2.4% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-4450

OpenJDK Launcher incorrect processing of empty library path entries (6983554)

Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier for Solaris and Linux; 5.0 Update 27 and earlier for Solaris and Linux; and 1.4.2_29 and earlier for Solaris and Linux allows local standalone applications to affect confidentiality, integrity, and availability via unknown vectors related to Launcher. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is an untrusted search path vulnerability involving an empty LD_LIBRARY_PATH environment variable.

CVSS 2.0 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Rhel Extras Jdk and 2 more

CVE-2010-4451

JDK unspecified vulnerability in Install component

Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier for Windows, when using Java Update, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install.

CVSS 2.0 · 7.6 High EPSS 3.4% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre

CVE-2010-4452

JDK unspecified vulnerability in Deployment component

Unspecified vulnerability in the Deployment component in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 83.0% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more