CVE-2010-4470
published 2011-02-17CVE-2010-4470: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows remote attackers…
PriorityP428medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
3.48%
87.7th percentile
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows remote attackers to affect availability via unknown vectors related to JAXP and unspecified APIs. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is related to "Features set on SchemaFactory not inherited by Validator."
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | jdk | <= 1.6.0 | — |
| sun | jdk | — | — |
| sun | jre | <= 1.6.0 | — |
| sun | jre | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat5.0MEDIUM
vendor_ubuntu2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-17·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: OpenJDK 6 vulnerabilities in Ubuntu 10.10 for armel (ARM) architecture.
USN-1079-2 fixed vulnerabilities in OpenJDK 6 for armel (ARM)
architectures in Ubuntu 9.10 and Ubuntu 10.04 LTS. This update fixes
vulnerabilities in OpenJDK 6 for armel (ARM) architectures for Ubuntu
10.10.
Original advisory details:
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execute arbitrary code as the user invoking
the program. (CVE-2010-4450)
It was discovered that within the Swing
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-15·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: OpenJDK 6 Vulnerabilities (armel packages only)
USN-1079-1 fixed vulnerabilities in OpenJDK 6 for non-armel (ARM)
architectures. This update provides the corresponding updates for
OpenJDK 6 for use with the armel (ARM) architectures.
In order to build the armel (ARM) OpenJDK 6 update for Ubuntu 10.04
LTS, it was necessary to rebuild binutils and gcj-4.4 from Ubuntu
10.04 LTS updates.
Original advisory details:
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execu
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-01·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execute arbitrary code as the user invoking
the program. (CVE-2010-4450)
It was discovered that within the Swing library, forged timer events
could allow bypass of SecurityManager checks. This could allow an
attacker to access restricted resources. (CVE-2010-4465)
It was discovered that certain bytecode combinations confused memory
management within the HotSpot JVM. This could allow an attacker to
cause a denial of service thr
Red Hat
OpenJDK JAXP untrusted component state manipulation (6927050)
vendor_redhat·2011-02-15·CVSS 5.0
CVE-2010-4470 [MEDIUM] OpenJDK JAXP untrusted component state manipulation (6927050)
OpenJDK JAXP untrusted component state manipulation (6927050)
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows remote attackers to affect availability via unknown vectors related to JAXP and unspecified APIs. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is related to "Features set on SchemaFactory not inherited by Validator."
GHSA
GHSA-rgfv-57h2-99r6: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows remote at
ghsa_unreviewed·2022-05-17
CVE-2010-4470 [MEDIUM] GHSA-rgfv-57h2-99r6: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows remote at
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows remote attackers to affect availability via unknown vectors related to JAXP and unspecified APIs. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is related to "Features set on SchemaFactory not inherited by Validator."
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.htmlhttp://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://secunia.com/advisories/43350http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.debian.org/security/2011/dsa-2224http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:054http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.htmlhttp://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0281.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0282.htmlhttp://www.securityfocus.com/bid/46387https://exchange.xforce.ibmcloud.com/vulnerabilities/65404https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12887https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14076http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.htmlhttp://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://secunia.com/advisories/43350http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.debian.org/security/2011/dsa-2224http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:054http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.htmlhttp://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0281.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0282.htmlhttp://www.securityfocus.com/bid/46387https://exchange.xforce.ibmcloud.com/vulnerabilities/65404https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12887https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14076
2011-02-17
Published