Description
Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow using an untrusted size value in the readMabCurveData function in the CMM module in the JVM.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.11.1-1jpp.3.el5 | RHSA-2010:0130 |
| RHEL 5 | java-1.5.0-sun-uninstall | 1.5.0.22-1jpp.3.el5 | RHSA-2010:0338 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.8-1jpp.1.el5 | RHSA-2010:0383 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.11.b16.el5 | RHSA-2010:0339 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.19-1jpp.1.el5 | RHSA-2010:0337 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.11.1-1jpp.3.el4 | RHSA-2010:0130 |
| RHEL 4 | java-1.5.0-sun-uninstall | 1.5.0.22-1jpp.3.el4 | RHSA-2010:0338 |
| RHEL 4 | java-1.6.0-ibm +6 | 1:1.6.0.8-1jpp.1.el4 | RHSA-2010:0383 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.19-1jpp.1.el4 | RHSA-2010:0337 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.8-1jpp.1.el4 | RHSA-2010:0471 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Java 6.19 CMM readMabCurveData - Remote Stack Overflow EDB-15056 · remote · Sep 20, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2010:0471 Red Hat Security Advisory: Red Hat Network Satellite Server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0383 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0339 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0337 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0338 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0130 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- APPLE-SA-2010-05-18-1 vendor-advisory
- oval:org.mitre.oval:def:10482 vdb-entry signature
- HPSBMU02799 vendor-advisory
- 39317 third-party-advisory
- RHSA-2010:0383 vendor-advisory
- 40545 third-party-advisory
- ADV-2010-1454 vdb-entry
- 39819 third-party-advisory
- 20100405 ZDI-10-061: Sun Java Runtime CMM readMabCurveData Remote Code Execution Vulnerability mailing-list
- 39069 vdb-entry
- ADV-2010-1107 vdb-entry
- RHSA-2010:0338 vendor-advisory
- ADV-2010-1793 vdb-entry
- APPLE-SA-2010-05-18-2 vendor-advisory
- SUSE-SR:2010:011 vendor-advisory
- 43308 third-party-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-10-061
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
- SSRT100179 vendor-advisory
- SSRT100089 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/javacpumar2010-083341.html
- RHSA-2010:0339 vendor-advisory
- 39292 third-party-advisory
- http://support.apple.com/kb/HT4170
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- SUSE-SR:2010:008 vendor-advisory
- 39659 third-party-advisory
- RHSA-2010:0471 vendor-advisory
- USN-923-1 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- RHSA-2010:0337 vendor-advisory
- javase-javab-java2d-unspecifed(57346) vdb-entry
- http://support.apple.com/kb/HT4171
- oval:org.mitre.oval:def:13923 vdb-entry signature
- MDVSA-2010:084 vendor-advisory
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- ADV-2010-1191 vdb-entry