ZeroDay Findings
Sign inSign up

Findings

CVE-2010-0840

Oracle JRE Unspecified Vulnerability

Published Apr 1, 2010 · updated Jun 16, 2026 · oracle jre

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

Timeline

Detection, updates, and resolution for this record.

  1. Apr 1, 2010 · Catalog

    Detected

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related

  2. May 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related

Required action

Apply updates per vendor instructions.

CISA due date Jun 15, 2022

Affected

  • cpe canonical/ubuntu linux8.04
  • cpe canonical/ubuntu linux8.10
  • cpe opensuse/opensuse11.0
  • cpe opensuse/opensuse11.1
  • cpe opensuse/opensuse11.2
  • cpe oracle/jre1.4.2_25
  • cpe oracle/jre1.5.0
  • cpe oracle/jre1.6.0
  • vendor Oracle Java Runtime Environment (JRE)version unspecified

Sources

  • CISA KEVCVE-2010-0840

    Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.

    cisa.gov
  • CVE.orgCVE-2010-0840

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2010-0840

    30-day exploitation probability 96.3%

    first.org
  • Exploit Database16297

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/browser/java_trusted_chain

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2010-0840

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information

    nvd.nist.gov

References