ID CVE-2010-0887
Summary Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
References
Vulnerable Configurations
  • cpe:2.3:a:sun:java:6:19:business
    cpe:2.3:a:sun:java:6:19:business
  • cpe:2.3:a:sun:java:6:18:se
    cpe:2.3:a:sun:java:6:18:se
  • cpe:2.3:a:sun:java:6:19:se
    cpe:2.3:a:sun:java:6:19:se
  • cpe:2.3:a:sun:java:6:18:business
    cpe:2.3:a:sun:java:6:18:business
CVSS
Base: 10.0 (as of 21-04-2010 - 15:47)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_0_JAVA-1_6_0-SUN-100420.NASL
    description Oracle has released JRE 6 Update 20 in order to fix potential remote code execution vulnerabilities (CVE-2010-0887). Please refer to Oracle's site for more information: http://www.oracle.com/technology/deploy/security/alerts/alert-cve-2010 -0886.html
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 45604
    published 2010-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=45604
    title openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2010:0140-1)
  • NASL family Windows
    NASL id ORACLE_JAVA6_UPDATE20.NASL
    description The version of Oracle (formerly Sun) Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 20. Such versions are potentially missing critical security updates.
    last seen 2019-02-21
    modified 2018-07-17
    plugin id 45544
    published 2010-04-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=45544
    title Oracle Java JDK / JRE 6 < Update 20 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_2_JAVA-1_6_0-SUN-100420.NASL
    description Oracle has released JRE 6 Update 20 in order to fix potential remote code execution vulnerabilities (CVE-2010-0887). Please refer to Oracle's site for more information: http://www.oracle.com/technology/deploy/security/alerts/alert-cve-2010 -0886.html
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 45606
    published 2010-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=45606
    title openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2010:0140-1)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20100419_JAVA__JDK_1_6_0__ON_SL4_X.NASL
    description This update fixes two vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the Oracle Security Alert page listed in the References section. (CVE-2010-0886, CVE-2010-0887) All running instances of Sun Java must be restarted for the update to take effect. NOTE: jdk-1.6.0_20-fcs.x86_64.rpm has not been signed. We cannot sign this package without breaking it.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 60782
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60782
    title Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_JAVA-1_6_0-SUN-100420.NASL
    description Oracle has released JRE 6 Update 20 in order to fix potential remote code execution vulnerabilities (CVE-2010-0887). Please refer to Oracle's site for more information: http://www.oracle.com/technology/deploy/security/alerts/alert-cve-2010 -0886.html
    last seen 2019-02-21
    modified 2013-11-18
    plugin id 50918
    published 2010-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50918
    title SuSE 11 Security Update : Sun Java 1.6.0 (SAT Patch Number 2340)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2010-0356.NASL
    description Updated java-1.6.0-sun packages that fix two security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. This update fixes two vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the Oracle Security Alert page listed in the References section. (CVE-2010-0886, CVE-2010-0887) Users of java-1.6.0-sun should upgrade to these updated packages, which correct these issues. All running instances of Sun Java must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 46300
    published 2010-05-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46300
    title RHEL 4 / 5 : java-1.6.0-sun (RHSA-2010:0356)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_1_JAVA-1_6_0-SUN-100420.NASL
    description Oracle has released JRE 6 Update 20 in order to fix potential remote code execution vulnerabilities (CVE-2010-0887). Please refer to Oracle's site for more information: http://www.oracle.com/technology/deploy/security/alerts/alert-cve-2010 -0886.html
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 45605
    published 2010-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=45605
    title openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2010:0140-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2010-0549.NASL
    description Updated java-1.6.0-ibm packages that fix one security issue are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. This update fixes one vulnerability in the IBM Java 2 Runtime Environment. This vulnerability is summarized on the IBM 'Security alerts' page listed in the References section. (CVE-2010-0887) All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.6.0 SR8-FP1 Java release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 47882
    published 2010-07-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47882
    title RHEL 4 / 5 : java-1.6.0-ibm (RHSA-2010:0549)
  • NASL family Misc.
    NASL id ORACLE_JAVA6_UPDATE20_UNIX.NASL
    description The version of Oracle (formerly Sun) Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 20. Such versions are potentially missing critical security updates. As a result, the remote host could be affected by multiple vulnerabilities.
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 64837
    published 2013-02-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64837
    title Oracle Java JDK / JRE 6 < Update 20 Multiple Vulnerabilities (Unix)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_JAVA_10_5_UPDATE7.NASL
    description The remote Mac OS X host is running a version of Java for Mac OS X 10.5 that is missing Update 7. The remote version of this software contains several security vulnerabilities, including some that may allow untrusted Java applets to obtain elevated privileges and lead to execution of arbitrary code with the privileges of the current user.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 46673
    published 2010-05-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46673
    title Mac OS X : Java for Mac OS X 10.5 Update 7
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201006-18.NASL
    description The remote host is affected by the vulnerability described in GLSA-201006-18 (Oracle JRE/JDK: Multiple vulnerabilities) Multiple vulnerabilities have been reported in the Oracle Java implementation. Please review the CVE identifiers referenced below and the associated Oracle Critical Patch Update Advisory for details. Impact : A remote attacker could exploit these vulnerabilities to cause unspecified impact, possibly including remote execution of arbitrary code. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 46807
    published 2010-06-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46807
    title GLSA-201006-18 : Oracle JRE/JDK: Multiple vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_JAVA_10_6_UPDATE2.NASL
    description The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 2. The remote version of this software contains several security vulnerabilities, including some that may allow untrusted Java applets to obtain elevated privileges and lead to execution of arbitrary code with the privileges of the current user.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 46674
    published 2010-05-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46674
    title Mac OS X : Java for Mac OS X 10.6 Update 2
redhat via4
advisories
  • bugzilla
    id 581237
    title CVE-2010-0886 CVE-2010-0887 Sun Java: Java Web Start arbitrary command line injection
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment java-1.6.0-sun is earlier than 1:1.6.0.20-1jpp.1.el5
          oval oval:com.redhat.rhsa:tst:20100356002
        • comment java-1.6.0-sun is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080594003
      • AND
        • comment java-1.6.0-sun-demo is earlier than 1:1.6.0.20-1jpp.1.el5
          oval oval:com.redhat.rhsa:tst:20100356008
        • comment java-1.6.0-sun-demo is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080594011
      • AND
        • comment java-1.6.0-sun-devel is earlier than 1:1.6.0.20-1jpp.1.el5
          oval oval:com.redhat.rhsa:tst:20100356004
        • comment java-1.6.0-sun-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080594007
      • AND
        • comment java-1.6.0-sun-jdbc is earlier than 1:1.6.0.20-1jpp.1.el5
          oval oval:com.redhat.rhsa:tst:20100356010
        • comment java-1.6.0-sun-jdbc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080594005
      • AND
        • comment java-1.6.0-sun-plugin is earlier than 1:1.6.0.20-1jpp.1.el5
          oval oval:com.redhat.rhsa:tst:20100356012
        • comment java-1.6.0-sun-plugin is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080594013
      • AND
        • comment java-1.6.0-sun-src is earlier than 1:1.6.0.20-1jpp.1.el5
          oval oval:com.redhat.rhsa:tst:20100356006
        • comment java-1.6.0-sun-src is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080594009
    rhsa
    id RHSA-2010:0356
    released 2010-04-19
    severity Critical
    title RHSA-2010:0356: java-1.6.0-sun security update (Critical)
  • bugzilla
    id 581237
    title CVE-2010-0886 CVE-2010-0887 Sun Java: Java Web Start arbitrary command line injection
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment java-1.6.0-ibm is earlier than 1:1.6.0.8.1-1jpp.2.el5
          oval oval:com.redhat.rhsa:tst:20100549002
        • comment java-1.6.0-ibm is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080267003
      • AND
        • comment java-1.6.0-ibm-accessibility is earlier than 1:1.6.0.8.1-1jpp.2.el5
          oval oval:com.redhat.rhsa:tst:20100549004
        • comment java-1.6.0-ibm-accessibility is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080267017
      • AND
        • comment java-1.6.0-ibm-demo is earlier than 1:1.6.0.8.1-1jpp.2.el5
          oval oval:com.redhat.rhsa:tst:20100549016
        • comment java-1.6.0-ibm-demo is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080267013
      • AND
        • comment java-1.6.0-ibm-devel is earlier than 1:1.6.0.8.1-1jpp.2.el5
          oval oval:com.redhat.rhsa:tst:20100549014
        • comment java-1.6.0-ibm-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080267009
      • AND
        • comment java-1.6.0-ibm-javacomm is earlier than 1:1.6.0.8.1-1jpp.2.el5
          oval oval:com.redhat.rhsa:tst:20100549010
        • comment java-1.6.0-ibm-javacomm is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080267015
      • AND
        • comment java-1.6.0-ibm-jdbc is earlier than 1:1.6.0.8.1-1jpp.2.el5
          oval oval:com.redhat.rhsa:tst:20100549012
        • comment java-1.6.0-ibm-jdbc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080267011
      • AND
        • comment java-1.6.0-ibm-plugin is earlier than 1:1.6.0.8.1-1jpp.2.el5
          oval oval:com.redhat.rhsa:tst:20100549008
        • comment java-1.6.0-ibm-plugin is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080267007
      • AND
        • comment java-1.6.0-ibm-src is earlier than 1:1.6.0.8.1-1jpp.2.el5
          oval oval:com.redhat.rhsa:tst:20100549006
        • comment java-1.6.0-ibm-src is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080267005
    rhsa
    id RHSA-2010:0549
    released 2010-07-21
    severity Critical
    title RHSA-2010:0549: java-1.6.0-ibm security update (Critical)
rpms
  • java-1.6.0-sun-1:1.6.0.20-1jpp.1.el5
  • java-1.6.0-sun-demo-1:1.6.0.20-1jpp.1.el5
  • java-1.6.0-sun-devel-1:1.6.0.20-1jpp.1.el5
  • java-1.6.0-sun-jdbc-1:1.6.0.20-1jpp.1.el5
  • java-1.6.0-sun-plugin-1:1.6.0.20-1jpp.1.el5
  • java-1.6.0-sun-src-1:1.6.0.20-1jpp.1.el5
  • java-1.6.0-ibm-1:1.6.0.8.1-1jpp.2.el5
  • java-1.6.0-ibm-accessibility-1:1.6.0.8.1-1jpp.2.el5
  • java-1.6.0-ibm-demo-1:1.6.0.8.1-1jpp.2.el5
  • java-1.6.0-ibm-devel-1:1.6.0.8.1-1jpp.2.el5
  • java-1.6.0-ibm-javacomm-1:1.6.0.8.1-1jpp.2.el5
  • java-1.6.0-ibm-jdbc-1:1.6.0.8.1-1jpp.2.el5
  • java-1.6.0-ibm-plugin-1:1.6.0.8.1-1jpp.2.el5
  • java-1.6.0-ibm-src-1:1.6.0.8.1-1jpp.2.el5
refmap via4
apple
  • APPLE-SA-2010-05-18-1
  • APPLE-SA-2010-05-18-2
confirm
hp HPSBMU02799
secunia 39819
vupen ADV-2010-1191
Last major update 22-08-2016 - 22:01
Published 20-04-2010 - 15:30
Back to Top