CVE-2010-4448
published 2011-02-17CVE-2010-4448: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and…
PriorityP413low2.6CVSS 2.0
AVNACHAuNCNIPAN
EPSS
2.41%
82.2th percentile
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to Networking. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue involves "DNS cache poisoning by untrusted applets."
Affected
68 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | jdk | <= 1.6.0 | — |
| sun | jdk | <= 1.5.0 | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jre | <= 1.6.0 | — |
| sun | jre | <= 1.5.0 | — |
| sun | jre | <= 1.4.2_29 | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
vendor_redhat2.6LOW
vendor_ubuntu2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-17·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: OpenJDK 6 vulnerabilities in Ubuntu 10.10 for armel (ARM) architecture.
USN-1079-2 fixed vulnerabilities in OpenJDK 6 for armel (ARM)
architectures in Ubuntu 9.10 and Ubuntu 10.04 LTS. This update fixes
vulnerabilities in OpenJDK 6 for armel (ARM) architectures for Ubuntu
10.10.
Original advisory details:
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execute arbitrary code as the user invoking
the program. (CVE-2010-4450)
It was discovered that within the Swing
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-15·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: OpenJDK 6 Vulnerabilities (armel packages only)
USN-1079-1 fixed vulnerabilities in OpenJDK 6 for non-armel (ARM)
architectures. This update provides the corresponding updates for
OpenJDK 6 for use with the armel (ARM) architectures.
In order to build the armel (ARM) OpenJDK 6 update for Ubuntu 10.04
LTS, it was necessary to rebuild binutils and gcj-4.4 from Ubuntu
10.04 LTS updates.
Original advisory details:
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execu
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-01·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execute arbitrary code as the user invoking
the program. (CVE-2010-4450)
It was discovered that within the Swing library, forged timer events
could allow bypass of SecurityManager checks. This could allow an
attacker to access restricted resources. (CVE-2010-4465)
It was discovered that certain bytecode combinations confused memory
management within the HotSpot JVM. This could allow an attacker to
cause a denial of service thr
Red Hat
OpenJDK DNS cache poisoning by untrusted applets (6981922)
vendor_redhat·2011-02-15·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK DNS cache poisoning by untrusted applets (6981922)
OpenJDK DNS cache poisoning by untrusted applets (6981922)
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to Networking. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue involves "DNS cache poisoning by untrusted applets."
GHSA
GHSA-q763-247f-jf2v: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5
ghsa_unreviewed·2022-05-14
CVE-2010-4448 [LOW] GHSA-q763-247f-jf2v: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to Networking. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue involves "DNS cache poisoning by untrusted applets."
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-05/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-07/msg00010.htmlhttp://marc.info/?l=bugtraq&m=133728004526190&w=2http://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://secunia.com/advisories/43350http://secunia.com/advisories/44954http://secunia.com/advisories/49198http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.debian.org/security/2011/dsa-2224http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:054http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.htmlhttp://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0281.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0282.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0880.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12906https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14045http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-05/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-07/msg00010.htmlhttp://marc.info/?l=bugtraq&m=133728004526190&w=2http://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://secunia.com/advisories/43350http://secunia.com/advisories/44954http://secunia.com/advisories/49198http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.debian.org/security/2011/dsa-2224http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:054http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.htmlhttp://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0281.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0282.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0880.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12906https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14045
2011-02-17
Published