Read the docs
TI-2010-00801 Aliases CVE-2010-0840GHSA-8rrv-3xx7-wmfc

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and…

Priority CRITICAL 100Exploited in the wildPublished · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

Why it matters now

Exploitation Active In CISA KEV since 2022-05-25CISA due date 2022-06-15
EPSS 0.96319 99th percentileScored 2026-11-07
Fix Fixed Red Hat: 8 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:oracle:jre:1.4.2_25:*:*:*:*:*:*:*1.4.2_25VulnerableOracle
cpe:2.3:a:oracle:jre:1.5.0:update23:*:*:*:*:*:*1.5.0 update23VulnerableOracle
cpe:2.3:a:oracle:jre:1.6.0:update18:*:*:*:*:*:*1.6.0 update18VulnerableOracle
cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*11.0VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*11.1VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*11.2VulnerableopenSUSE
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*8.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*8.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*9.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*9.10VulnerableCanonical
  • cpe:2.3:a:oracle:jre:1.4.2_25:*:*:*:*:*:*:* Versions 1.4.2_25 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jre:1.5.0:update23:*:*:*:*:*:* Versions 1.5.0 update23 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jre:1.6.0:update18:*:*:*:*:*:* Versions 1.6.0 update18 Vulnerable ·Oracle
  • cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:* Versions 11.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:* Versions 11.2 Vulnerable ·openSUSE
  • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* Versions 8.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* Versions 8.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* Versions 9.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:* Versions 9.10 Vulnerable ·Canonical

Remediation

Red Hat 8 advisories

  • RHSA-2010:0586 Released 2010-08-02 · Red Hat rating Moderate
    java-1.4.2-ibm-sap security update
    • RHEL 4 AS for SAP java-1.4.2-ibm-sap-1.4.2.13.5.sap-1jpp.1.el4_8, java-1.4.2-ibm-sap-demo-1.4.2.13.5.sap-1jpp.1.el4_8, java-1.4.2-ibm-sap-devel-1.4.2.13.5.sap-1jpp.1.el4_8 +2
    • RHEL 5 Server for SAP java-1.4.2-ibm-sap-1.4.2.13.5.sap-1jpp.1.el5, java-1.4.2-ibm-sap-demo-1.4.2.13.5.sap-1jpp.1.el5, java-1.4.2-ibm-sap-devel-1.4.2.13.5.sap-1jpp.1.el5 +2
  • RHSA-2010:0574 Released 2010-07-29 · Red Hat rating Critical
    java-1.4.2-ibm security update
    • Red Hat Desktop version 3 Extras java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3.i386, java-1.4.2-ibm-demo-1.4.2.13.5-1jpp.1.el3 +7
    • Red Hat Desktop version 4 Extras java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4.i386, java-1.4.2-ibm-demo-1.4.2.13.5-1jpp.1.el4 +9
    • Red Hat Enterprise Linux AS version 3 Extras java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3.i386, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3.ia64 +17
    • Red Hat Enterprise Linux AS version 4 Extras java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4.ia64 +20
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el5, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el5.i386, java-1.4.2-ibm-demo-1.4.2.13.5-1jpp.1.el5 +9
    • Red Hat Enterprise Linux ES version 3 Extras java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3.i386, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3.ia64 +11
    • Red Hat Enterprise Linux ES version 4 Extras java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4.ia64 +13
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el5, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el5.i386, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el5.ia64 +20
    • Red Hat Enterprise Linux WS version 3 Extras java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3.i386, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el3.ia64 +11
    • Red Hat Enterprise Linux WS version 4 Extras java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.5-1jpp.1.el4.ia64 +13
  • RHSA-2010:0489 Released 2010-06-17 · Red Hat rating Critical
    java-1.5.0-ibm security update
    • Red Hat Desktop version 4 Extras java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el4, java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.11.2-1jpp.1.el4 +9
    • Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el4, java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el4.i386, java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el4.ppc +17
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el5, java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el5.i386, java-1.5.0-ibm-accessibility-1:1.5.0.11.2-1jpp.1.el5 +11
    • Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el4, java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.11.2-1jpp.1.el4 +9
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el5, java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el5.i386, java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el5.ppc +20
    • Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el4, java-1.5.0-ibm-1:1.5.0.11.2-1jpp.1.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.11.2-1jpp.1.el4 +9
Show 5 more Red Hat advisories
  • RHSA-2010:0471 Released 2010-06-14 · Red Hat rating Low
    Red Hat Network Satellite Server IBM Java Runtime security update
    • Red Hat Satellite 5.3 (RHEL v.4) java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4, java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4.i386, java-1.6.0-ibm-devel-1:1.6.0.8-1jpp.1.el4 +1
    • Red Hat Satellite 5.3 (RHEL v.5) java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el5, java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el5.i386, java-1.6.0-ibm-devel-1:1.6.0.8-1jpp.1.el5 +1
  • RHSA-2010:0383 Released 2010-04-29 · Red Hat rating Critical
    java-1.6.0-ibm security update
    • Red Hat Desktop version 4 Extras java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4, java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.8-1jpp.1.el4 +11
    • Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4, java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4.i386, java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4.ppc +18
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el5, java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el5.i386, java-1.6.0-ibm-accessibility-1:1.6.0.8-1jpp.1.el5 +13
    • Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4, java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.8-1jpp.1.el4 +11
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el5, java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el5.i386, java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el5.ppc +21
    • Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4, java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.8-1jpp.1.el4 +11
  • RHSA-2010:0338 Released 2010-04-01 · Red Hat rating Critical
    java-1.5.0-sun security update
    • RHEL Supplementary (v. 5.2.Z server) java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5.i586
    • RHEL Supplementary (v. 5.3.Z server) java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5.i586
    • Red Hat Desktop version 4 Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
    • Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
    • Red Hat Enterprise Linux AS version 4.7.z Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5.i586
    • Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
    • Red Hat Enterprise Linux ES version 4.7.z Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5.i586
    • Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
  • RHSA-2010:0337 Released 2010-04-01 · Red Hat rating Critical
    java-1.6.0-sun security update
    • Red Hat Desktop version 4 Extras java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el4 +9
    • Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el4 +9
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-sun-1:1.6.0.19-1jpp.1.el5, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el5.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el5 +9
    • Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el4 +9
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-sun-1:1.6.0.19-1jpp.1.el5, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el5.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el5 +9
    • Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el4 +9
  • RHSA-2010:0339 Released 2010-04-01 · Red Hat rating Important
    java-1.6.0-openjdk security update
    • Red Hat Enterprise Linux (v. 5 server) java-1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5, java-1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.11.b16.el5 +7
    • Red Hat Enterprise Linux Desktop (v. 5 client) java-1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5, java-1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.11.b16.el5 +7

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL 4 AS for SAPFixed RHSA-2010:0586
RHEL 5 Server for SAPFixed RHSA-2010:0586
RHEL Supplementary (v. 5.2.Z server)Fixed RHSA-2010:0338
RHEL Supplementary (v. 5.3.Z server)Fixed RHSA-2010:0338
Red Hat Desktop version 3 ExtrasFixed RHSA-2010:0574
Red Hat Desktop version 4 ExtrasFixed RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0383, RHSA-2010:0489, RHSA-2010:0574
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2010:0339
Red Hat Enterprise Linux AS version 3 ExtrasFixed RHSA-2010:0574
Red Hat Enterprise Linux AS version 4 ExtrasFixed RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0383, RHSA-2010:0489, RHSA-2010:0574
Red Hat Enterprise Linux AS version 4.7.z ExtrasFixed RHSA-2010:0338
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2010:0339
Red Hat Enterprise Linux Desktop Supplementary (v. 5)Fixed RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0383, RHSA-2010:0489, RHSA-2010:0574
Red Hat Enterprise Linux ES version 3 ExtrasFixed RHSA-2010:0574
Red Hat Enterprise Linux ES version 4 ExtrasFixed RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0383, RHSA-2010:0489, RHSA-2010:0574
Red Hat Enterprise Linux ES version 4.7.z ExtrasFixed RHSA-2010:0338
Red Hat Enterprise Linux Server Supplementary (v. 5)Fixed RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0383, RHSA-2010:0489, RHSA-2010:0574
Red Hat Enterprise Linux WS version 3 ExtrasFixed RHSA-2010:0574
Red Hat Enterprise Linux WS version 4 ExtrasFixed RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0383, RHSA-2010:0489, RHSA-2010:0574
Red Hat Satellite 5.3 (RHEL v.4)Fixed RHSA-2010:0471
Red Hat Satellite 5.3 (RHEL v.5)Fixed RHSA-2010:0471

Timeline

  1. 2022-05-25 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2010-0840
  3. 2026-10-03 Alias added: GHSA-8rrv-3xx7-wmfc

References

Patch 2

Advisory 24

Other 4

  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-02278 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02212 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-00349 Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-04270 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-03989 Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
See all 816 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences