CVE-2010-3573

Description

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.

References

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12220

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11990

https://bugzilla.redhat.com/show_bug.cgi?id=642202

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

http://www.ubuntu.com/usn/USN-1010-1

http://www.securityfocus.com/archive/1/516397/100/0/threaded

http://www.redhat.com/support/errata/RHSA-2011-0880.html

http://www.redhat.com/support/errata/RHSA-2010-0987.html

http://www.redhat.com/support/errata/RHSA-2010-0873.html

http://www.redhat.com/support/errata/RHSA-2010-0865.html

http://www.redhat.com/support/errata/RHSA-2010-0807.html

http://www.redhat.com/support/errata/RHSA-2010-0770.html

http://www.redhat.com/support/errata/RHSA-2010-0768.html

http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html

http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html

http://support.avaya.com/css/P8/documents/100123193

http://support.avaya.com/css/P8/documents/100114327

http://support.avaya.com/css/P8/documents/100114315

http://security.gentoo.org/glsa/glsa-201406-32.xml

http://secunia.com/advisories/44954

http://secunia.com/advisories/42974

http://secunia.com/advisories/41972

http://secunia.com/advisories/41967

http://marc.info/?l=bugtraq&m=134254866602253&w=2

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3