CVE-2010-4471
published 2011-02-17CVE-2010-4471: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, and 5.0 Update 27 and earlier…
PriorityP425medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.27%
81.1th percentile
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, and 5.0 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to 2D. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is related to the exposure of system properties via vectors related to Font.createFont and exception text.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | jdk | <= 1.6.0 | — |
| sun | jdk | <= 1.5.0 | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jre | <= 1.6.0 | — |
| sun | jre | <= 1.5.0 | — |
| sun | jre | — | — |
| sun | jre | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.0MEDIUM
vendor_ubuntu2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-17·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: OpenJDK 6 vulnerabilities in Ubuntu 10.10 for armel (ARM) architecture.
USN-1079-2 fixed vulnerabilities in OpenJDK 6 for armel (ARM)
architectures in Ubuntu 9.10 and Ubuntu 10.04 LTS. This update fixes
vulnerabilities in OpenJDK 6 for armel (ARM) architectures for Ubuntu
10.10.
Original advisory details:
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execute arbitrary code as the user invoking
the program. (CVE-2010-4450)
It was discovered that within the Swing
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-15·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: OpenJDK 6 Vulnerabilities (armel packages only)
USN-1079-1 fixed vulnerabilities in OpenJDK 6 for non-armel (ARM)
architectures. This update provides the corresponding updates for
OpenJDK 6 for use with the armel (ARM) architectures.
In order to build the armel (ARM) OpenJDK 6 update for Ubuntu 10.04
LTS, it was necessary to rebuild binutils and gcj-4.4 from Ubuntu
10.04 LTS updates.
Original advisory details:
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execu
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-01·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execute arbitrary code as the user invoking
the program. (CVE-2010-4450)
It was discovered that within the Swing library, forged timer events
could allow bypass of SecurityManager checks. This could allow an
attacker to access restricted resources. (CVE-2010-4465)
It was discovered that certain bytecode combinations confused memory
management within the HotSpot JVM. This could allow an attacker to
cause a denial of service thr
Red Hat
OpenJDK Java2D font-related system property leak (6985453)
vendor_redhat·2011-02-15·CVSS 5.0
CVE-2010-4471 [MEDIUM] OpenJDK Java2D font-related system property leak (6985453)
OpenJDK Java2D font-related system property leak (6985453)
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, and 5.0 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to 2D. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is related to the exposure of system properties via vectors related to Font.createFont and exception text.
GHSA
GHSA-6jc7-hhf7-27hm: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, and 5
ghsa_unreviewed·2022-05-17
CVE-2010-4471 [MEDIUM] GHSA-6jc7-hhf7-27hm: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, and 5
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, and 5.0 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to 2D. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is related to the exposure of system properties via vectors related to Font.createFont and exception text.
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.htmlhttp://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://secunia.com/advisories/43350http://secunia.com/advisories/44954http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.debian.org/security/2011/dsa-2224http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:054http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.htmlhttp://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0282.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0880.htmlhttp://www.securityfocus.com/bid/46399https://exchange.xforce.ibmcloud.com/vulnerabilities/65405https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12089https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14417http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.htmlhttp://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://secunia.com/advisories/43350http://secunia.com/advisories/44954http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.debian.org/security/2011/dsa-2224http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:054http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.htmlhttp://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0282.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0880.htmlhttp://www.securityfocus.com/bid/46399https://exchange.xforce.ibmcloud.com/vulnerabilities/65405https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12089https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14417
2011-02-17
Published