CVE-2010-3567 Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via....

HighCVSS 10.0 EPSS 4.9%

Published: 2010-10-20 00:00
Updated: 2026-06-17 02:23
Exploit status: No public exploit known

Description

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to a calculation error in right-to-left text character counts for the ICU OpenType font rendering implementation, which triggers an out-of-bounds memory access.

Affected products

Product	Affected versions	Fixed in
sun jre	<= 1.6.0	No fix listed
sun jre	= 1.6.0	No fix listed
sun jre	= 1.6.0-update_1	No fix listed
sun jre	= 1.6.0-update_10	No fix listed
sun jre	= 1.6.0-update_11	No fix listed
sun jre	= 1.6.0-update_12	No fix listed
sun jre	= 1.6.0-update_13	No fix listed
sun jre	= 1.6.0-update_14	No fix listed
sun jre	= 1.6.0-update_15	No fix listed
sun jre	= 1.6.0-update_16	No fix listed
sun jre	= 1.6.0-update_17	No fix listed
sun jre	= 1.6.0-update_18	No fix listed
sun jre	= 1.6.0-update_19	No fix listed
sun jre	= 1.6.0-update_2	No fix listed
sun jre	= 1.6.0-update_20	No fix listed
sun jre	= 1.6.0-update_3	No fix listed
sun jre	= 1.6.0-update_4	No fix listed
sun jre	= 1.6.0-update_5	No fix listed
sun jre	= 1.6.0-update_6	No fix listed
sun jre	= 1.6.0-update_7	No fix listed
sun jre	<= 1.5.0	No fix listed
sun jre	= 1.5.0	No fix listed
sun jre	= 1.5.0-update1	No fix listed
sun jre	= 1.5.0-update10	No fix listed
sun jre	= 1.5.0-update11	No fix listed

Show 68 more

Product	Affected versions	Fixed in
sun jre	= 1.5.0-update12	No fix listed
sun jre	= 1.5.0-update13	No fix listed
sun jre	= 1.5.0-update14	No fix listed
sun jre	= 1.5.0-update15	No fix listed
sun jre	= 1.5.0-update16	No fix listed
sun jre	= 1.5.0-update17	No fix listed
sun jre	= 1.5.0-update18	No fix listed
sun jre	= 1.5.0-update19	No fix listed
sun jre	= 1.5.0-update2	No fix listed
sun jre	= 1.5.0-update20	No fix listed
sun jre	= 1.5.0-update21	No fix listed
sun jre	= 1.5.0-update22	No fix listed
sun jre	= 1.5.0-update23	No fix listed
sun jre	= 1.5.0-update24	No fix listed
sun jre	= 1.5.0-update3	No fix listed
sun jre	= 1.5.0-update4	No fix listed
sun jre	= 1.5.0-update5	No fix listed
sun jre	= 1.5.0-update6	No fix listed
sun jre	= 1.5.0-update7	No fix listed
sun jre	= 1.5.0-update8	No fix listed
sun jre	= 1.5.0-update9	No fix listed
sun jdk	<= 1.6.0	No fix listed
sun jdk	= 1.6.0	No fix listed
sun jdk	= 1.6.0-update_10	No fix listed
sun jdk	= 1.6.0-update_11	No fix listed
sun jdk	= 1.6.0-update_12	No fix listed
sun jdk	= 1.6.0-update_13	No fix listed
sun jdk	= 1.6.0-update_14	No fix listed
sun jdk	= 1.6.0-update_15	No fix listed
sun jdk	= 1.6.0-update_16	No fix listed
sun jdk	= 1.6.0-update_17	No fix listed
sun jdk	= 1.6.0-update_18	No fix listed
sun jdk	= 1.6.0-update_19	No fix listed
sun jdk	= 1.6.0-update_20	No fix listed
sun jdk	= 1.6.0-update_3	No fix listed
sun jdk	= 1.6.0-update_4	No fix listed
sun jdk	= 1.6.0-update_5	No fix listed
sun jdk	= 1.6.0-update_6	No fix listed
sun jdk	= 1.6.0-update_7	No fix listed
sun jdk	= 1.6.0-update1	No fix listed
sun jdk	= 1.6.0-update1_b06	No fix listed
sun jdk	= 1.6.0-update2	No fix listed
sun jdk	<= 1.5.0	No fix listed
sun jdk	= 1.5.0	No fix listed
sun jdk	= 1.5.0-update1	No fix listed
sun jdk	= 1.5.0-update10	No fix listed
sun jdk	= 1.5.0-update11	No fix listed
sun jdk	= 1.5.0-update12	No fix listed
sun jdk	= 1.5.0-update13	No fix listed
sun jdk	= 1.5.0-update14	No fix listed
sun jdk	= 1.5.0-update15	No fix listed
sun jdk	= 1.5.0-update16	No fix listed
sun jdk	= 1.5.0-update17	No fix listed
sun jdk	= 1.5.0-update18	No fix listed
sun jdk	= 1.5.0-update19	No fix listed
sun jdk	= 1.5.0-update2	No fix listed
sun jdk	= 1.5.0-update20	No fix listed
sun jdk	= 1.5.0-update21	No fix listed
sun jdk	= 1.5.0-update22	No fix listed
sun jdk	= 1.5.0-update23	No fix listed
sun jdk	= 1.5.0-update24	No fix listed
sun jdk	= 1.5.0-update3	No fix listed
sun jdk	= 1.5.0-update4	No fix listed
sun jdk	= 1.5.0-update5	No fix listed
sun jdk	= 1.5.0-update6	No fix listed
sun jdk	= 1.5.0-update7	No fix listed
sun jdk	= 1.5.0-update8	No fix listed
sun jdk	= 1.5.0-update9	No fix listed

References

SSRT100333 vendor-advisory
FEDORA-2010-16312 vendor-advisory
FEDORA-2010-16294 vendor-advisory
FEDORA-2010-16240 vendor-advisory
SUSE-SR:2010:019 vendor-advisory
HPSBMU02799 vendor-advisory
41972 third-party-advisory vendor-advisory
42377 third-party-advisory vendor-advisory
42974 third-party-advisory vendor-advisory
GLSA-201406-32 vendor-advisory
support.avaya.com
support.avaya.com
support.avaya.com
www.hitachi.co.jp
www.oracle.com
www.oracle.com patch vendor-advisory
RHSA-2010:0768 vendor-advisory
RHSA-2010:0770 vendor-advisory
RHSA-2010:0865 vendor-advisory
20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
43992 vdb-entry
USN-1010-1 vendor-advisory
www.vmware.com
ADV-2010-3086 vdb-entry vendor-advisory
bugzilla.redhat.com
oval:org.mitre.oval:def:11714 signature vdb-entry
oval:org.mitre.oval:def:12153 signature vdb-entry

CVSS v2.0

10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Weakness & likelihood

EPSS (exploitation probability, 30 days): 4.90% (percentile 92.2)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.