CVE-2010-3559

JDK unspecified vulnerability in Sound component

Published Oct 19, 2010 CVSS 2.0 · 10.0 Critical EPSS 9.7% KEV · Not listed
Description
Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this involves an incorrect sign extension in the HeadspaceSoundbank.nGetName function, which allows attackers to execute arbitrary code via a crafted BANK record that leads to a buffer overflow.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
oracle
Published
Updated
Aug 7, 2024, 3:11 AM
Reserved
Sep 20, 2010, 12:00 AM
Status
Modified
Published
Oct 19, 2010, 10:00 PM
Modified
Jun 16, 2026, 11:23 PM
Severity
Critical
Public date
Oct 12, 2010, 12:00 AM