CVE-2010-0838 Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availabili...

HighCVSS 7.5 EPSS 14.9% Public exploit

Published: 2010-04-01 19:00
Updated: 2026-06-17 02:16
Exploit status: Public exploit available

Description

Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow using an untrusted size value in the readMabCurveData function in the CMM module in the JVM.

Affected products

Product	Affected versions	Fixed in
sun jre	<= 1.6.0	No fix listed
sun jre	= 1.6.0	No fix listed
sun jre	= 1.6.0-update_1	No fix listed
sun jre	= 1.6.0-update_10	No fix listed
sun jre	= 1.6.0-update_11	No fix listed
sun jre	= 1.6.0-update_12	No fix listed
sun jre	= 1.6.0-update_13	No fix listed
sun jre	= 1.6.0-update_14	No fix listed
sun jre	= 1.6.0-update_15	No fix listed
sun jre	= 1.6.0-update_16	No fix listed
sun jre	= 1.6.0-update_17	No fix listed
sun jre	= 1.6.0-update_2	No fix listed
sun jre	= 1.6.0-update_3	No fix listed
sun jre	= 1.6.0-update_4	No fix listed
sun jre	= 1.6.0-update_5	No fix listed
sun jre	= 1.6.0-update_6	No fix listed
sun jre	= 1.6.0-update_7	No fix listed
sun jre	<= 1.5.0	No fix listed
sun jre	= 1.5.0	No fix listed
sun jre	= 1.5.0-update1	No fix listed
sun jre	= 1.5.0-update10	No fix listed
sun jre	= 1.5.0-update11	No fix listed
sun jre	= 1.5.0-update12	No fix listed
sun jre	= 1.5.0-update13	No fix listed
sun jre	= 1.5.0-update14	No fix listed

Show 56 more

Product	Affected versions	Fixed in
sun jre	= 1.5.0-update15	No fix listed
sun jre	= 1.5.0-update16	No fix listed
sun jre	= 1.5.0-update17	No fix listed
sun jre	= 1.5.0-update18	No fix listed
sun jre	= 1.5.0-update19	No fix listed
sun jre	= 1.5.0-update2	No fix listed
sun jre	= 1.5.0-update20	No fix listed
sun jre	= 1.5.0-update21	No fix listed
sun jre	= 1.5.0-update3	No fix listed
sun jre	= 1.5.0-update4	No fix listed
sun jre	= 1.5.0-update5	No fix listed
sun jre	= 1.5.0-update6	No fix listed
sun jre	= 1.5.0-update7	No fix listed
sun jre	= 1.5.0-update8	No fix listed
sun jre	= 1.5.0-update9	No fix listed
sun jdk	<= 1.6.0	No fix listed
sun jdk	= 1.6.0	No fix listed
sun jdk	= 1.6.0-update_10	No fix listed
sun jdk	= 1.6.0-update_11	No fix listed
sun jdk	= 1.6.0-update_12	No fix listed
sun jdk	= 1.6.0-update_13	No fix listed
sun jdk	= 1.6.0-update_14	No fix listed
sun jdk	= 1.6.0-update_15	No fix listed
sun jdk	= 1.6.0-update_16	No fix listed
sun jdk	= 1.6.0-update_17	No fix listed
sun jdk	= 1.6.0-update_3	No fix listed
sun jdk	= 1.6.0-update_4	No fix listed
sun jdk	= 1.6.0-update_5	No fix listed
sun jdk	= 1.6.0-update_6	No fix listed
sun jdk	= 1.6.0-update_7	No fix listed
sun jdk	= 1.6.0-update1	No fix listed
sun jdk	= 1.6.0-update1_b06	No fix listed
sun jdk	= 1.6.0-update2	No fix listed
sun jdk	<= 1.5.0	No fix listed
sun jdk	= 1.5.0	No fix listed
sun jdk	= 1.5.0-update1	No fix listed
sun jdk	= 1.5.0-update10	No fix listed
sun jdk	= 1.5.0-update11	No fix listed
sun jdk	= 1.5.0-update12	No fix listed
sun jdk	= 1.5.0-update13	No fix listed
sun jdk	= 1.5.0-update14	No fix listed
sun jdk	= 1.5.0-update15	No fix listed
sun jdk	= 1.5.0-update16	No fix listed
sun jdk	= 1.5.0-update17	No fix listed
sun jdk	= 1.5.0-update18	No fix listed
sun jdk	= 1.5.0-update19	No fix listed
sun jdk	= 1.5.0-update2	No fix listed
sun jdk	= 1.5.0-update20	No fix listed
sun jdk	= 1.5.0-update21	No fix listed
sun jdk	= 1.5.0-update3	No fix listed
sun jdk	= 1.5.0-update4	No fix listed
sun jdk	= 1.5.0-update5	No fix listed
sun jdk	= 1.5.0-update6	No fix listed
sun jdk	= 1.5.0-update7	No fix listed
sun jdk	= 1.5.0-update8	No fix listed
sun jdk	= 1.5.0-update9	No fix listed

References

SSRT100179 vendor-advisory
APPLE-SA-2010-05-18-1 vendor-advisory
APPLE-SA-2010-05-18-2 vendor-advisory
SUSE-SR:2010:008 vendor-advisory
SUSE-SR:2010:011 vendor-advisory
SSRT100089 vendor-advisory
HPSBMU02799 vendor-advisory
39292 third-party-advisory vendor-advisory
39317 third-party-advisory vendor-advisory
39659 third-party-advisory vendor-advisory
39819 third-party-advisory vendor-advisory
40545 third-party-advisory vendor-advisory
43308 third-party-advisory vendor-advisory
support.apple.com
support.apple.com
USN-923-1 vendor-advisory
MDVSA-2010:084 vendor-advisory
www.oracle.com
www.oracle.com
RHSA-2010:0337 vendor-advisory
RHSA-2010:0338 vendor-advisory
RHSA-2010:0339 vendor-advisory
RHSA-2010:0383 vendor-advisory
RHSA-2010:0471 vendor-advisory
20100405 ZDI-10-061: Sun Java Runtime CMM readMabCurveData Remote Code Execution Vulnerability mailing-list
20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
39069 vdb-entry
www.vmware.com
www.vmware.com
ADV-2010-1107 vdb-entry vendor-advisory
ADV-2010-1191 vdb-entry vendor-advisory
ADV-2010-1454 vdb-entry vendor-advisory
ADV-2010-1793 vdb-entry vendor-advisory
www.zerodayinitiative.com
javase-javab-java2d-unspecifed(57346) vdb-entry
oval:org.mitre.oval:def:10482 signature vdb-entry
oval:org.mitre.oval:def:13923 signature vdb-entry

CVSS v2.0

7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 14.90% (percentile 96.8)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Java 6.19 CMM readMabCurveData - Remote Stack Overflow Exploit · Exploit Database (OffSec) · 2010-09-20