超危
Oracle Java SE和Java for Business JRE不受信任目标代码执行漏洞
2010-04-01 16:00:00 公开 ，2026-02-17 19:23:51 更新
- 关键漏洞
- CISA KEV
- 公开PoC
- 远程
- 无需认证
- SSVC：
- 可利用状态：已被积极利用攻击自动化：是技术影响评估：全部 2025-02-11 02:55:12
风险信息
- CVSS v2 向量
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- CVSS v2 风险值
- 7.5
- CVSS v3.1 向量
- AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 9.8
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- Oracle Java SE和Java for Business Java Runtime Environment可能允许远程攻击者在系统上执行任意代码，这是由与不受信任对象相关的错误引起的，这些对象扩展了受信任的类而没有覆盖目标方法。通过说服受害者访问包含巧尽心思构建的小程序的网页，攻击者可以利用此漏洞执行任意代码。
- 修复建议
- 目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www.oracle.com/technology/deploy/security/critical-patch-updates/javacpumar2010.html
参考链接
- http://www.oracle.com/technology/deploy/security/critical-patch-updates/javacpumar2010.html
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
NVD · vendor-advisory · x_refsource_HP
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
NVD · vendor-advisory · x_refsource_MANDRIVA
- http://www.redhat.com/support/errata/RHSA-2010-0471.html
NVD · vendor-advisory · x_refsource_REDHAT
- http://marc.info/?l=bugtraq&m=127557596201693&w=2
NVD · vendor-advisory · x_refsource_HP
- http://ubuntu.com/usn/usn-923-1
NVD · vendor-advisory · x_refsource_UBUNTU
- http://www.redhat.com/support/errata/RHSA-2010-0337.html
NVD · vendor-advisory · x_refsource_REDHAT
- http://www.zerodayinitiative.com/advisories/ZDI-10-056
NVD · x_refsource_MISC
- http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
NVD · vendor-advisory · x_refsource_SUSE
- http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
NVD · vendor-advisory · x_refsource_APPLE
- http://support.apple.com/kb/HT4171
NVD · x_refsource_CONFIRM
- http://www.redhat.com/support/errata/RHSA-2010-0338.html
NVD · vendor-advisory · x_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2010-0489.html
NVD · vendor-advisory · x_refsource_REDHAT
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
NVD · vendor-advisory · x_refsource_SUSE
- http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751
NVD · vendor-advisory · x_refsource_HP
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
NVD · x_refsource_CONFIRM
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
NVD · vendor-advisory · x_refsource_SUSE
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
NVD · x_refsource_CONFIRM
- http://lists.apple.com/archives/security-announce/2010//May/msg00001.html
NVD · vendor-advisory · x_refsource_APPLE
- http://support.apple.com/kb/HT4170
NVD · x_refsource_CONFIRM
- http://www.oracle.com/technetwork/topics/security/javacpumar2010-083341.html
NVD · x_refsource_CONFIRM
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
NVD · x_refsource_CONFIRM
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9974
NVD · vdb-entry · signature · x_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13971
NVD · vdb-entry · signature · x_refsource_OVAL
- http://www.redhat.com/support/errata/RHSA-2010-0339.html
NVD · vendor-advisory · x_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2010-0383.html
NVD · vendor-advisory · x_refsource_REDHAT
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0840
NVD · US Government Resource