CVE-2010-4448

OpenJDK DNS cache poisoning by untrusted applets (6981922)

Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to Networking. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue involves "DNS cache poisoning by untrusted applets."

CVSS 2.0 · 2.6 Low EPSS 2.4% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-4447

JDK unspecified vulnerability in Deployment component

Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Deployment, a different vulnerability than CVE-2010-4475.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 3 more

CVE-2010-4422

JDK unspecified vulnerability in Deployment component

Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 7.6 High EPSS 3.4% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2010-3574

OpenJDK HttpURLConnection incomplete TRACE permission check (6981426)

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.

CVSS 2.0 · 10.0 Critical EPSS 4.9% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 3 more

CVE-2010-3573

OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004)

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.

CVSS 2.0 · 5.1 Medium EPSS 10.6% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2010-3572

JDK unspecified vulnerability in Sound component

Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.2% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 3 more

CVE-2010-3571

JDK unspecified vulnerability in 2D component

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the color profile parser that allows remote attackers to execute arbitrary code via a crafted Tag structure in a color profile.

CVSS 2.0 · 10.0 Critical EPSS 9.1% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 3 more

CVE-2010-3569

OpenJDK Serialization inconsistencies (6966692)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to execute arbitrary code by causing the defaultReadObject method in the Serialization API to set a volatile field multiple times.

CVSS 2.0 · 10.0 Critical EPSS 7.1% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-3568

OpenJDK Deserialization Race condition (6559775)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a race condition related to deserialization.

CVSS 2.0 · 10.0 Critical EPSS 4.9% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-3566

OpenJDK ICC Profile remote code execution (6963489)

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that leads to a buffer overflow via a crafted devs (device information) tag structure in a color profile.

CVSS 2.0 · 10.0 Critical EPSS 5.9% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2010-3565

OpenJDK JPEG writeImage remote code execution (6963023)

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that triggers memory corruption via large values in a subsample of a JPEG image, related to JPEGImageWriter.writeImage in the imageio API.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-3563

OpenJDK: unspecified vulnerability in Deployment component

Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to "how Web Start retrieves security policies," BasicServiceImpl, and forged policies that bypass sandbox restrictions.

CVSS 2.0 · 10.0 Critical EPSS 84.2% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2010-3562

OpenJDK IndexColorModel double-free (6925710)

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a double free vulnerability in IndexColorModel that allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.

CVSS 2.0 · 10.0 Critical EPSS 7.1% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-3560

JDK unspecified vulnerability in Networking component

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality via unknown vectors.

CVSS 2.0 · 2.6 Low EPSS 2.7% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2010-3558

JDK unspecified vulnerability in Java Web Start component

Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 4.9% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2010-3557

OpenJDK Swing mutable static (6938813)

Unspecified vulnerability in the Swing component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to the modification of "behavior and state of certain JDK classes" and "mutable static."

CVSS 2.0 · 6.8 Medium EPSS 2.9% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-3556

JDK unspecified vulnerability in 2D component

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.2% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 3 more

CVE-2010-3555

JDK unspecified vulnerability in Deployment component

Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that the ActiveX Plugin does not properly initialize an object field that is used as a window handle, which allows attackers to execute arbitrary code.

CVSS 2.0 · 9.3 Critical EPSS 8.0% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2010-3553

OpenJDK Swing unsafe reflection usage (6622002)

Unspecified vulnerability in the Swing component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to unsafe reflection involving the UIDefault.ProxyLazyValue class.

CVSS 2.0 · 10.0 Critical EPSS 4.9% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more

CVE-2010-3551

OpenJDK local network address disclosure (6952603)

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 4 more