WaratekVRT Sign in

Java SE CPU Mar 2010

Released March 2010 · Oracle's advisory ↗ · ← Critical Patch Update, January 2010 · Critical Patch Update, April 2010 →

27 CVEs in this release, one square each

Mitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploited
Share this chart Java SE CPU Mar 2010, one square per CVE: 12 Java CVEs, 4 exploited, 15 other CVEs in this release.

Download the image

By status

1Mitigation candidate11No exploit published14Outside Waratek scope1Not applicable 4Exploited, marked by the ring

No exploit published. For 7 of them, Oracle's security advisory is the source of public detail.

Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Published from 2010-01-01✕Has a public PoC✕
Overview 4 matches · 1 in Waratek scope · 0 protected · 3 exploited · 1 CISA KEV · 3 EPSS ≥ 0.5
4matches 1in Waratek scope25.0% 0protected0.0% 3exploited75.0% 1CISA KEV25.0% 3EPSS ≥ 0.575.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 25.0% No exploit published 0 0.0% Outside Waratek scope 3 75.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 1 25.0% High 3 75.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 75.0% Working exploit published 1 25.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / month
Outside Waratek scope: 3Mitigation candidate: 1 High: 3Critical: 1 not blocked: 4 Working exploit published: 1Exploited: 3
Apr 104 Mitigation candidate1 Outside Waratek scope3 Critical1 High3 not blocked4 Exploited3 Working exploit published1
Apr 10
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2010-0842 High 2010-04-01 Outside Waratek scope Exploited Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object, related to the GM_Song structure.
CVE-2010-0840 Critical 2010-04-01 Outside Waratek scope Exploited Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
CVE-2010-0838 High 2010-04-01 Mitigation candidate Working exploit published Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow using an untrusted size value in the readMabCurveData function in the CMM module in the JVM.
CVE-2010-0094 High 2010-04-01 Outside Waratek scope Exploited Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is due to missing privilege checks during deserialization of RMIConnectionImpl objects, which allows remote attackers to call system-level Java functions via the ClassLoader of a constructor that is being deserialized.