Skip to content
OpenAdvisories
Critical · 9.8 Known exploited Public exploit CVE-2010-0840 EUVD-2010-0865GHSA-8rrv-3xx7-wmfc

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and…

Published Apr 1, 2010 · Updated Oct 22, 2025 · Assigned by oracle

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 5 java-1.4.2-ibm +6 1.4.2.13.5-1jpp.1.el5 RHSA-2010:0574
RHEL 5 java-1.4.2-ibm-sap +4 1.4.2.13.5.sap-1jpp.1.el5 RHSA-2010:0586
RHEL 5 java-1.5.0-ibm +7 1:1.5.0.11.2-1jpp.1.el5 RHSA-2010:0489
RHEL 5 java-1.5.0-sun-uninstall 1.5.0.22-1jpp.3.el5 RHSA-2010:0338
RHEL 5 java-1.6.0-ibm +7 1:1.6.0.8-1jpp.1.el5 RHSA-2010:0383
RHEL 5 java-1.6.0-openjdk +4 1:1.6.0.0-1.11.b16.el5 RHSA-2010:0339
RHEL 5 java-1.6.0-sun +5 1:1.6.0.19-1jpp.1.el5 RHSA-2010:0337
RHEL 4 java-1.4.2-ibm +6 1.4.2.13.5-1jpp.1.el4 RHSA-2010:0574
RHEL 4 java-1.4.2-ibm-sap +4 1.4.2.13.5.sap-1jpp.1.el4_8 RHSA-2010:0586
RHEL 4 java-1.5.0-ibm +6 1:1.5.0.11.2-1jpp.1.el4 RHSA-2010:0489
RHEL 4 java-1.5.0-sun-uninstall 1.5.0.22-1jpp.3.el4 RHSA-2010:0338
RHEL 4 java-1.6.0-ibm +6 1:1.6.0.8-1jpp.1.el4 RHSA-2010:0383
RHEL 4 java-1.6.0-sun +5 1:1.6.0.19-1jpp.1.el4 RHSA-2010:0337
RHEL 3 java-1.4.2-ibm +5 1.4.2.13.5-1jpp.1.el3 RHSA-2010:0574
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Network Satellite 5 java-1.6.0-ibm +1 1:1.6.0.8-1jpp.1.el4 RHSA-2010:0471

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 8

References