CVE-2010-3554

Publication date 19 October 2010

Last updated 24 July 2024

Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to "permissions granted to certain system objects."

From the Ubuntu Security Team

It was discovered that multiple flaws in the CORBA reflection implementation could allow an attacker to execute arbitrary code by misusing permissions granted to certain system objects.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openjdk-6	10.10 maverick	Fixed 6b20-1.9.1-1ubuntu3
	10.04 LTS lucid	Fixed 1.8.2-4ubuntu2
	9.10 karmic	Fixed 1.8.2-4ubuntu1~9.10.1
	9.04 jaunty	Fixed 1.8.2-4ubuntu1~9.04.1
	8.04 LTS hardy	Fixed 1.8.2-4ubuntu1~8.04.1
	6.06 LTS dapper	Not in release
openjdk-6b18	10.10 maverick	Fixed 6b18-1.8.2-4ubuntu1
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
sun-java6	10.10 maverick	Fixed 6.22-0ubuntu1~10.10
	10.04 LTS lucid	Fixed 6.22-0ubuntu1~10.04
	9.10 karmic	Fixed 6.22-0ubuntu1~9.10.1
	9.04 jaunty	Fixed 6.22-0ubuntu1~9.04.1
	8.04 LTS hardy	Fixed 6.22-0ubuntu1~8.04.1
	6.06 LTS dapper	Not in release

Notes

sbeattie

red hat description: Flaws in the CORBA implementation could allow an attacker to execute arbitrary code by misusing permissions granted to certain system objects.

CVE-2010-3554

From the Ubuntu Security Team

Status

Notes

sbeattie

References

Related Ubuntu Security Notices (USN)

Other references