WaratekVRT Sign in

Oracle Critical Patch Update January 2011

Released January 2011 · Oracle's advisory ↗ · ← Java SE Critical Patch Update, October 2010 · Java SE Critical Patch Update, February 2011 →

66 CVEs in this release, one square each

Protected by WaratekMitigation candidateMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploitedNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update January 2011, one square per CVE: 31 Java CVEs, 1 protected by Waratek, 1 exploited, 35 other CVEs in this release.

Download the image

By status

1Protected by Waratek3Mitigation candidate27No exploit published11Outside Waratek scope24Not applicable 1Exploited, marked by the ring

No exploit published. For 26 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 24 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
24matches 0in Waratek scope0.0% 0protected0.0% 1exploited4.2% 0CISA KEV0.0% 3public PoC12.5% 1EPSS ≥ 0.54.2%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 24 100.0% Withdrawn CVE 0 0.0%
Critical 1 4.2% High 6 25.0% Medium 14 58.3% Low 3 12.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 24 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 4.2% Working exploit published 2 8.3% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 21 87.5%
split by peak 20 / month
Not applicable: 24 Low: 3Medium: 14High: 6Critical: 1 not blocked: 24 No public exploit: 21Working exploit published: 2Exploited: 1
Nov 091 Not applicable1 Critical1 not blocked1 Exploited1 Dec 090 Jan 100 Feb 100 Mar 100 Apr 101 Not applicable1 Medium1 not blocked1 No public exploit1 May 100 Jun 100 Jul 100 Aug 102 Not applicable2 High2 not blocked2 No public exploit2 Sep 100 Oct 100 Nov 100 Dec 100 Jan 1120 Not applicable20 High4 Medium13 Low3 not blocked20 Working exploit published2 No public exploit18
Nov 09Jan 10Mar 10May 10Jul 10Sep 10Nov 10Jan 11
24 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2010-4464 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Convergence 1.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail.
CVE-2010-4460 Low 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Solaris 10 allows local users to affect confidentiality and integrity via unknown vectors related to Fault Manager Daemon.
CVE-2010-4459 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Solaris 11 Express allows local users to affect availability via unknown vectors related to SCTP and Kernel/sockfs.
CVE-2010-4458 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Solaris 11 Express allows local users to affect availability, related to ZFS.
CVE-2010-4457 High 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Solaris 11 Express allows remote attackers to affect availability, related to SMB and CIFS.
CVE-2010-4456 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Java System Communications Express 6.2 and 6.3 allows remote attackers to affect integrity via unknown vectors related to Web Mail.
CVE-2010-4449 High 2011-01-19 Not applicable No public exploit Unspecified vulnerability in the Audit Vault component in Oracle Audit Vault 10.2.3.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that this issue is related to a crafted parameter in an action.execute request to the av component on TCP port 5700.
CVE-2010-4446 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Solaris 11 Express allows local users to affect availability via unknown vectors related to RDS and Kernel/InfiniBand.
CVE-2010-4444 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Java System Access Manager and Oracle OpenSSO 7, 7.1, and 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2010-4443 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Solaris 10 and 11 Express allows local users to affect availability, related to Kernel/NFS.
CVE-2010-4442 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Solaris 10 and 11 Express allows local users to affect availability via unknown vectors related to the Kernel.
CVE-2010-4440 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle 10 and 11 Express allows local users to affect availability via unknown vectors related to the Kernel.
CVE-2010-4436 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Management Center (SunMC) 4.0 allows remote attackers to affect confidentiality via unknown vectors related to Web Console.
CVE-2010-4435 High 2011-01-19 Not applicable Working exploit published Unspecified vulnerability in Oracle Solaris 8, 9, and 10 allows remote attackers to affect confidentiality, integrity, and availability, related to CDE Calendar Manager Service Daemon and RPC. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from other software vendors that this affects other operating systems, such as HP-UX, or claims from a reliable third party that this is a buffer overflow in rpc.cmsd via long XDR-encoded ASCII strings in RPC call 10.
CVE-2010-4433 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Solaris 10 allows remote attackers to affect confidentiality via unknown vectors related to Ethernet and the Driver sub-component.
CVE-2010-4431 Low 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Java System Portal Server 7.1 and 7.2 allows local users to affect confidentiality via unknown vectors related to Proxy.
CVE-2010-4415 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Solaris 8, 9, and 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to libc.
CVE-2010-4414 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle VM VirtualBox 4.0 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Extensions.
CVE-2010-3586 Low 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Solaris 9 allows local users to affect confidentiality and integrity via unknown vectors related to XScreenSaver.
CVE-2010-2632 High 2011-01-19 Not applicable Working exploit published Unspecified vulnerability in the FTP Server in Oracle Solaris 8, 9, 10, and 11 Express allows remote attackers to affect availability. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable researcher that this is an issue in the glob implementation in libc that allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames.
CVE-2010-2936 High 2010-08-25 Not applicable No public exploit Integer overflow in simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted polygons in a PowerPoint document that triggers a heap-based buffer overflow.
CVE-2010-2935 High 2010-08-25 Not applicable No public exploit simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an "integer truncation error."
CVE-2010-1227 Medium 2010-04-01 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Sun Java System Communications Express 6.2 and 6.3 allows remote attackers to inject arbitrary web script or HTML via the subject field of a message, as demonstrated by a subject containing an IMG element with a SRC attribute that performs a cross-site request forgery (CSRF) attack involving the cmd and argv parameters to cmd.msc.
CVE-2009-3555 Critical 2009-11-09 Not applicable Exploited The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.