CVE-2010-0843 json
Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27…
published 2010-04-01 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-0868
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.2%
- EPSS 6.2% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to XNewPtr and improper handling of an integer parameter when allocating heap memory in the com.sun.media.sound libraries, which allows remote attackers to execute arbitrary code.
Patch / fix
- java-1.4.2-ibm RHEL 3 EXTRAS 1.4.2.13.5-1jpp.1.el3
- java-1.4.2-ibm RHEL 4 EXTRAS 1.4.2.13.5-1jpp.1.el4
- java-1.4.2-ibm RHEL 5 EXTRAS 1.4.2.13.5-1jpp.1.el5
- java-1.4.2-ibm-src RHEL 3 EXTRAS 1.4.2.13.5-1jpp.1.el3
- java-1.4.2-ibm-src RHEL 4 EXTRAS 1.4.2.13.5-1jpp.1.el4
- java-1.4.2-ibm-src RHEL 5 EXTRAS 1.4.2.13.5-1jpp.1.el5
- java-1.4.2-ibm-demo RHEL 3 EXTRAS 1.4.2.13.5-1jpp.1.el3
- java-1.4.2-ibm-demo RHEL 4 EXTRAS 1.4.2.13.5-1jpp.1.el4
red hat advisories RHSA-2010:0574RHSA-2010:0489RHSA-2010:0383RHSA-2010:0471RHSA-2010:0586RHSA-2010:0338
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2010-0843 updated cvss 7.5
JDK multiple unspecified vulnerabilities
-
Red Hat Desktop version 3 Extras java-1.4.2-ibm 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-src 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-demo 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-jdbc 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-plugin 1.4.2.13.5-1jpp.1.el3 Red Hat Desktop version 4 Extras java-1.6.0-ibm 1.6.0.8-1jpp.1.el4, java-1.6.0-sun 1.6.0.19-1jpp.1.el4, java-1.4.2-ibm 1.4.2.13.5-1jpp.1.el4, java-1.5.0-ibm 1.5.0.11.2-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.8-1jpp.1.el4, java-1.6.0-ibm-demo 1.6.0.8-1jpp.1.el4, +18 more Red Hat Enterprise Linux AS version 3 Extras java-1.4.2-ibm 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-src 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-demo 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-jdbc 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-plugin 1.4.2.13.5-1jpp.1.el3 Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-ibm 1.6.0.8-1jpp.1.el4, java-1.6.0-sun 1.6.0.19-1jpp.1.el4, java-1.4.2-ibm 1.4.2.13.5-1jpp.1.el4, java-1.5.0-ibm 1.5.0.11.2-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.8-1jpp.1.el4, java-1.6.0-ibm-demo 1.6.0.8-1jpp.1.el4, +18 morefixed: vendor fix RHSA-2010:0574
-
Red Hat Enterprise Linux AS version 4.7.z Extras java-1.5.0-sun-uninstall 1.5.0.22-1jpp.3.el4fixed: vendor fix RHSA-2010:0338
-
Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm 1.6.0.8-1jpp.1.el5, java-1.6.0-sun 1.6.0.19-1jpp.1.el5, java-1.4.2-ibm 1.4.2.13.5-1jpp.1.el5, java-1.5.0-ibm 1.5.0.11.2-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.8-1jpp.1.el5, java-1.6.0-ibm-demo 1.6.0.8-1jpp.1.el5, +20 more Red Hat Enterprise Linux ES version 3 Extras java-1.4.2-ibm 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-src 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-demo 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-jdbc 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-plugin 1.4.2.13.5-1jpp.1.el3 Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-ibm 1.6.0.8-1jpp.1.el4, java-1.6.0-sun 1.6.0.19-1jpp.1.el4, java-1.4.2-ibm 1.4.2.13.5-1jpp.1.el4, java-1.5.0-ibm 1.5.0.11.2-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.8-1jpp.1.el4, java-1.6.0-ibm-demo 1.6.0.8-1jpp.1.el4, +18 morefixed: vendor fix RHSA-2010:0574
-
Red Hat Enterprise Linux ES version 4.7.z Extras java-1.5.0-sun-uninstall 1.5.0.22-1jpp.3.el4fixed: vendor fix RHSA-2010:0338
-
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm 1.6.0.8-1jpp.1.el5, java-1.6.0-sun 1.6.0.19-1jpp.1.el5, java-1.4.2-ibm 1.4.2.13.5-1jpp.1.el5, java-1.5.0-ibm 1.5.0.11.2-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.8-1jpp.1.el5, java-1.6.0-ibm-demo 1.6.0.8-1jpp.1.el5, +20 more Red Hat Enterprise Linux WS version 3 Extras java-1.4.2-ibm 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-src 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-demo 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-jdbc 1.4.2.13.5-1jpp.1.el3, java-1.4.2-ibm-plugin 1.4.2.13.5-1jpp.1.el3 Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-ibm 1.6.0.8-1jpp.1.el4, java-1.6.0-sun 1.6.0.19-1jpp.1.el4, java-1.4.2-ibm 1.4.2.13.5-1jpp.1.el4, java-1.5.0-ibm 1.5.0.11.2-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.8-1jpp.1.el4, java-1.6.0-ibm-demo 1.6.0.8-1jpp.1.el4, +18 morefixed: vendor fix RHSA-2010:0574
-
Red Hat Satellite 5.3 (RHEL v.4) java-1.6.0-ibm 1.6.0.8-1jpp.1.el4 Red Hat Satellite 5.3 (RHEL v.5) java-1.6.0-ibm 1.6.0.8-1jpp.1.el5fixed: vendor fix RHSA-2010:0471
-
Red Hat RHEL 4 AS for SAP java-1.4.2-ibm-sap 1.4.2.13.5.sap-1jpp.1.el4_8, java-1.4.2-ibm-sap-src 1.4.2.13.5.sap-1jpp.1.el4_8, java-1.4.2-ibm-sap-demo 1.4.2.13.5.sap-1jpp.1.el4_8, java-1.4.2-ibm-sap-javacomm 1.4.2.13.5.sap-1jpp.1.el4_8 Red Hat RHEL 5 Server for SAP java-1.4.2-ibm-sap 1.4.2.13.5.sap-1jpp.1.el5, java-1.4.2-ibm-sap-src 1.4.2.13.5.sap-1jpp.1.el5, java-1.4.2-ibm-sap-demo 1.4.2.13.5.sap-1jpp.1.el5, java-1.4.2-ibm-sap-javacomm 1.4.2.13.5.sap-1jpp.1.el5fixed: vendor fix RHSA-2010:0586
-
Red Hat RHEL Supplementary (v. 5.2.Z server) java-1.5.0-sun-uninstall 1.5.0.22-1jpp.3.el5 Red Hat RHEL Supplementary (v. 5.3.Z server) java-1.5.0-sun-uninstall 1.5.0.22-1jpp.3.el5fixed: vendor fix RHSA-2010:0338
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
6.19% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
lists.apple.com
/archives/security-announce/2010//May/msg00001.html
vendor-advisory
-
marc.info
/?l=bugtraq&m=134254866602253&w=2
vendor-advisory
-
redhat.com
/support/errata/RHSA-2010-0383.html
vendor-advisory
-
redhat.com
/support/errata/RHSA-2010-0338.html
vendor-advisory
-
lists.apple.com
/archives/security-announce/2010//May/msg00002.html
vendor-advisory
-
itrc.hp.com
/service/cki/docDisplay.do?docId=emr_na-c02273751
vendor-advisory
-
marc.info
/?l=bugtraq&m=127557596201693&w=2
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2010-04/msg00001.html
vendor-advisory
-
redhat.com
/support/errata/RHSA-2010-0471.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2010-09/msg00006.html
vendor-advisory
-
redhat.com
/support/errata/RHSA-2010-0337.html
vendor-advisory
-
redhat.com
/support/errata/RHSA-2010-0489.html
vendor-advisory
-
secunia.com
/advisories/39317
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/40545
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2010/1454
vdb-entry, vendor-advisory
-
secunia.com
/advisories/39819
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2010/1793
vdb-entry, vendor-advisory
-
secunia.com
/advisories/43308
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2010/1523
vdb-entry, vendor-advisory
-
secunia.com
/advisories/39659
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/40211
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2010/1191
vdb-entry, vendor-advisory
- zerodayinitiative.com /advisories/ZDI-10-052/
-
securityfocus.com
/bid/39083
vdb-entry
-
osvdb.org
/63492
vdb-entry
- oracle.com /technetwork/topics/security/cpuoct2010-175626.html
- oracle.com /technetwork/topics/security/javacpumar2010-083341.html
- support.apple.com /kb/HT4170
- vmware.com /support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14092
vdb-entry, signature
- vmware.com /security/advisories/VMSA-2011-0003.html
- support.apple.com /kb/HT4171
-
seclists.org
/bugtraq/2010/Apr/41
mailing-list
-
securityfocus.com
/archive/1/516397/100/0/threaded
mailing-list
Sources
- CVE List CVE-2010-0843
- NVD CVE-2010-0843
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.