CVE-2010-0842
| Affected software | 2 products, listed below |
|---|---|
| Severity | 7.5 High CVSS 2.0 |
| Published | 1 Apr 2010 |
| Updated | 19 Oct 2026 |
Description
Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object, related to the GM_Song structure.
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 2 citations · earliest 2011-05-24.
- CISA Vulnrichment no assessment published
- Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB, Metasploit; first seen 2012-02-16.
- EPSS 78% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.6% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2010-0842 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | securelist.com | /max-sets-its-sights-on-x64-platforms/29672 | 2011-05-24 |
| Reported exploitation | isc.sans.edu | /diary/12400 | 2012-01-14 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| Exploit-DB | Java MixerSequencer Object - GM_Song Structure Handling (Metasploit) | 2012-02-16 | |
| Metasploit | Java MixerSequencer Object GM_Song Structure Handling Vulnerability (great rank) |
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher set this CVE's status to Outside Waratek scope. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Client-side: the bug is reached through an applet in the browser plug-in, on the user's machine, not in a server JVM the agent protects. The only public exploit is Metasploit's windows/browser/java_mixer_sequencer (EDB-18485), an applet that plays a crafted MIDI file through a MixerSequencer object. The defect itself is an uncontrolled array index on the GM_Song structure in the JDK's native sound engine, so the fix is in native code as well (jdk-native). Affects only JDK 6 and older, which have no OpenJDK builds to patch.
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Java SE CPU Mar 2010 ↗ | CPU | 2010-Q1 | Java SE and Java for Business / Sound (6 Update 18, 5.0 Update 23, 1.4.2_25, 1.3.1_27) Oracle's note: See note 1. May also be potentially vulnerable through processing untrusted data using APIs in the specified Component, and without using Java Web Start applications and applets. |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Java SE and Java for Business | Sound | 6 Update 18, 5.0 Update 23, 1.4.2_25, 1.3.1_27 | 3.1.27.0 · 4.2.25.0 · 5.0.23.0 · 6.0.18.0 |
Products and versions
3 products, 238 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | sun | jdk | javase | 1.3.0 · 1.3.0_01 · 1.3.0_02 · 1.3.0_03 · 1.3.0_04 · 1.3.0_05 · 1.3.1 · 1.3.1_01 · 1.3.1_01a · 1.3.1_02 · 1.3.1_03 · 1.3.1_04 · 1.3.1_05 · 1.3.1_06 · 1.3.1_07 · 1.3.1_08 · 1.3.1_09 · 1.3.1_10 · 1.3.1_11 · 1.3.1_12 · 1.3.1_13 · 1.3.1_14 · 1.3.1_15 · 1.3.1_16 · 1.3.1_17 · 1.3.1_18 · 1.3.1_19 · 1.3.1_20 · 1.3.1_21 · 1.3.1_22 · 1.3.1_23 · 1.3.1_24 · 1.3.1_25 · 1.3.1_26 · ≤ 3.1.27.0 · 1.5.0 · ≤ 5.0.0.0 · 1.5.0:update1 · 1.5.0:update2 · 1.5.0:update3 · 1.5.0:update4 · 1.5.0:update5 · 1.5.0:update6 · 1.5.0:update7 · 1.5.0:update8 · 1.5.0:update9 · 1.5.0:update10 · 1.5.0:update11 · 1.5.0:update12 · 1.5.0:update13 · 1.5.0:update14 · 1.5.0:update15 · 1.5.0:update16 · 1.5.0:update17 · 1.5.0:update18 · 1.5.0:update19 · 1.5.0:update20 · 1.5.0:update21 · 1.6.0 · ≤ 6.0.0.0 · 1.6.0:update1 · 1.6.0:update1_b06 · 1.6.0:update2 · 1.6.0:update_3 · 1.6.0:update_4 · 1.6.0:update_5 · 1.6.0:update_6 · 1.6.0:update_7 · 1.6.0:update_10 · 1.6.0:update_11 · 1.6.0:update_12 · 1.6.0:update_13 · 1.6.0:update_14 · 1.6.0:update_15 · 1.6.0:update_16 · 1.6.0:update_17 |
| nvd | sun | jre | javase | 1.3.0 · 1.3.0:update1 · 1.3.0:update2 · 1.3.0:update3 · 1.3.0:update4 · 1.3.0:update5 · 1.3.1 · 1.3.1:update1 · 1.3.1:update2 · 1.3.1_2 · 1.3.1_03 · 1.3.1_04 · 1.3.1_05 · 1.3.1_06 · 1.3.1_07 · 1.3.1_08 · 1.3.1_09 · 1.3.1_10 · 1.3.1_11 · 1.3.1_12 · 1.3.1_13 · 1.3.1_14 · 1.3.1_15 · 1.3.1_16 · 1.3.1_17 · 1.3.1_18 · 1.3.1_19 · 1.3.1_20 · 1.3.1_21 · 1.3.1_22 · 1.3.1_23 · 1.3.1_24 · 1.3.1_25 · 1.3.1_26 · ≤ 3.1.27.0 · 1.4.2 · 1.4.2_1 · 1.4.2_2 · 1.4.2_3 · 1.4.2_4 · 1.4.2_5 · 1.4.2_6 · 1.4.2_7 · 1.4.2_8 · 1.4.2_9 · 1.4.2_10 · 1.4.2_11 · 1.4.2_12 · 1.4.2_13 · 1.4.2_14 · 1.4.2_15 · 1.4.2_16 · 1.4.2_17 · 1.4.2_18 · 1.4.2_19 · 1.4.2_20 · 1.4.2_21 · 1.4.2_22 · 1.4.2_23 · 1.4.2_24 · ≤ 4.2.25.0 · 1.5.0 · ≤ 5.0.0.0 · 1.5.0:update1 · 1.5.0:update2 · 1.5.0:update3 · 1.5.0:update4 · 1.5.0:update5 · 1.5.0:update6 · 1.5.0:update7 · 1.5.0:update8 · 1.5.0:update9 · 1.5.0:update10 · 1.5.0:update11 · 1.5.0:update12 · 1.5.0:update13 · 1.5.0:update14 · 1.5.0:update15 · 1.5.0:update16 · 1.5.0:update17 · 1.5.0:update18 · 1.5.0:update19 · 1.5.0:update20 · 1.5.0:update21 · 1.6.0 · ≤ 6.0.0.0 · 1.6.0:update_1 · 1.6.0:update_2 · 1.6.0:update_3 · 1.6.0:update_4 · 1.6.0:update_5 · 1.6.0:update_6 · 1.6.0:update_7 · 1.6.0:update_10 · 1.6.0:update_11 · 1.6.0:update_12 · 1.6.0:update_13 · 1.6.0:update_14 · 1.6.0:update_15 · 1.6.0:update_16 · 1.6.0:update_17 |
| nvd | sun | sdk | generic | 1.3.0 · 1.3.0_01 · 1.3.0_02 · 1.3.0_03 · 1.3.0_04 · 1.3.0_05 · 1.3.1 · 1.3.1_01 · 1.3.1_01a · 1.3.1_02 · 1.3.1_03 · 1.3.1_04 · 1.3.1_05 · 1.3.1_06 · 1.3.1_07 · 1.3.1_08 · 1.3.1_09 · 1.3.1_10 · 1.3.1_11 · 1.3.1_12 · 1.3.1_13 · 1.3.1_14 · 1.3.1_15 · 1.3.1_16 · 1.3.1_17 · 1.3.1_18 · 1.3.1_19 · 1.3.1_20 · 1.3.1_21 · 1.3.1_22 · 1.3.1_23 · 1.3.1_24 · 1.3.1_25 · 1.3.1_26 · ≤ 1.3.1.27 · 1.4.2 · 1.4.2_1 · 1.4.2_02 · 1.4.2_3 · 1.4.2_4 · 1.4.2_5 · 1.4.2_6 · 1.4.2_7 · 1.4.2_8 · 1.4.2_9 · 1.4.2_10 · 1.4.2_11 · 1.4.2_12 · 1.4.2_13 · 1.4.2_14 · 1.4.2_15 · 1.4.2_16 · 1.4.2_17 · 1.4.2_18 · 1.4.2_19 · 1.4.2_20 · 1.4.2_21 · 1.4.2_22 · 1.4.2_23 · 1.4.2_24 · ≤ 1.4.2.25 |
References
Timeline
Timeline
| Published | 2010-04-01 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2011-05-24 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| VulnCheck KEV: latest evidence | 2012-01-14 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-06-16 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-10-19 | Most recent commit touching this CVE's classification, patch or rule file. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |