CVE-2010-3566
Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that leads to a buffer overflow via a crafted devs (device information) tag structure in a color profile.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 5.88% probability · 93th percentile
- CISA KEV
- Not listed
- Affected
- sun/jre · sun/jdk
- Source
- secalert_us@oracle.com
References
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://secunia.com/advisories/41967Vendor Advisory
- http://secunia.com/advisories/41972Vendor Advisory
- http://secunia.com/advisories/42377Vendor Advisory
- http://secunia.com/advisories/42974Vendor Advisory
- http://secunia.com/advisories/44954Vendor Advisory
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://support.avaya.com/css/P8/documents/100114315
- http://support.avaya.com/css/P8/documents/100123193
- http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html
- http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.htmlPatch, Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0770.html
- http://www.redhat.com/support/errata/RHSA-2010-0807.htmlVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0873.htmlVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0987.htmlVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2011-0880.htmlVendor Advisory
- http://www.securityfocus.com/archive/1/516397/100/0/threaded
- http://www.securityfocus.com/bid/43988
- http://www.ubuntu.com/usn/USN-1010-1
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- http://www.vupen.com/english/advisories/2010/3086Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-10-204/
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11560
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12225
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.