CVE-2010-0840

Oracle JRE Unspecified Vulnerability

Published Apr 1, 2010 · updated Jun 16, 2026 · n/a n/a

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Apr 1, 2010 · Catalog
Detected
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related
May 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related

Required action

Apply updates per vendor instructions.

CISA due date Jun 15, 2022

Affected

cpe canonical/ubuntu linux8.04
cpe canonical/ubuntu linux8.10
cpe opensuse/opensuse11.0
cpe opensuse/opensuse11.1
cpe opensuse/opensuse11.2
cpe oracle/jre1.4.2_25
cpe oracle/jre1.5.0
cpe oracle/jre1.6.0
vendor Oracle Java Runtime Environment (JRE)version unspecified
vendor n/a n/aversion unspecified

Sources

CISA KEVConfirmed exploitationCVE-2010-0840
Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.
cisa.gov
CVE.orgVulnerability recordCVE-2010-0840
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information
cve.org
FIRST EPSSExploitation probabilityCVE-2010-0840
30-day exploitation probability 96.3%
first.org
Exploit DatabasePublic exploit reference16297
Public archive entry. The exploit body is not stored here.
exploit-db.com
Metasploit ModulesPublic exploit moduleexploit_multi/browser/java_trusted_chain
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com
NIST NVDVulnerability recordCVE-2010-0840
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information
nvd.nist.gov