CVE-2010-4472
published 2011-02-17CVE-2010-4472: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote attackers to…
PriorityP415low2.6CVSS 2.0
AVNACHAuNCNINAP
EPSS
3.01%
85.8th percentile
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote attackers to affect availability, related to XML Digital Signature and unspecified APIs. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue involves the replacement of the "XML DSig Transform or C14N algorithm implementations."
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | jdk | <= 1.6.0 | — |
| sun | jdk | — | — |
| sun | jre | <= 1.6.0 | — |
| sun | jre | — | — |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:N/A:P
vendor_redhat2.6LOW
vendor_ubuntu2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-17·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: OpenJDK 6 vulnerabilities in Ubuntu 10.10 for armel (ARM) architecture.
USN-1079-2 fixed vulnerabilities in OpenJDK 6 for armel (ARM)
architectures in Ubuntu 9.10 and Ubuntu 10.04 LTS. This update fixes
vulnerabilities in OpenJDK 6 for armel (ARM) architectures for Ubuntu
10.10.
Original advisory details:
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execute arbitrary code as the user invoking
the program. (CVE-2010-4450)
It was discovered that within the Swing
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-15·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: OpenJDK 6 Vulnerabilities (armel packages only)
USN-1079-1 fixed vulnerabilities in OpenJDK 6 for non-armel (ARM)
architectures. This update provides the corresponding updates for
OpenJDK 6 for use with the armel (ARM) architectures.
In order to build the armel (ARM) OpenJDK 6 update for Ubuntu 10.04
LTS, it was necessary to rebuild binutils and gcj-4.4 from Ubuntu
10.04 LTS updates.
Original advisory details:
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execu
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-03-01·CVSS 2.6
CVE-2010-4448 [LOW] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
It was discovered that untrusted Java applets could create domain
name resolution cache entries, allowing an attacker to manipulate
name resolution within the JVM. (CVE-2010-4448)
It was discovered that the Java launcher did not did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker
could exploit this to execute arbitrary code as the user invoking
the program. (CVE-2010-4450)
It was discovered that within the Swing library, forged timer events
could allow bypass of SecurityManager checks. This could allow an
attacker to access restricted resources. (CVE-2010-4465)
It was discovered that certain bytecode combinations confused memory
management within the HotSpot JVM. This could allow an attacker to
cause a denial of service thr
Red Hat
OpenJDK untrusted code allowed to replace DSIG/C14N implementation (6994263)
vendor_redhat·2011-02-15·CVSS 2.6
CVE-2010-4472 [LOW] OpenJDK untrusted code allowed to replace DSIG/C14N implementation (6994263)
OpenJDK untrusted code allowed to replace DSIG/C14N implementation (6994263)
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote attackers to affect availability, related to XML Digital Signature and unspecified APIs. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue involves the replacement of the "XML DSig Transform or C14N algorithm implementations."
GHSA
GHSA-2qxc-rxrw-rpvh: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote attacker
ghsa_unreviewed·2022-05-17
CVE-2010-4472 [LOW] GHSA-2qxc-rxrw-rpvh: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote attacker
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote attackers to affect availability, related to XML Digital Signature and unspecified APIs. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue involves the replacement of the "XML DSig Transform or C14N algorithm implementations."
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.htmlhttp://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://secunia.com/advisories/43350http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.debian.org/security/2011/dsa-2224http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:054http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.htmlhttp://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0281.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0282.htmlhttp://www.securityfocus.com/bid/46404https://exchange.xforce.ibmcloud.com/vulnerabilities/65411https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12903https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14118http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.htmlhttp://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://secunia.com/advisories/43350http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.debian.org/security/2011/dsa-2224http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:054http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.htmlhttp://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0281.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0282.htmlhttp://www.securityfocus.com/bid/46404https://exchange.xforce.ibmcloud.com/vulnerabilities/65411https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12903https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14118
2011-02-17
Published