CVE-2010-3568

Published: 19 October 2010

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a race condition related to deserialization.

From the Ubuntu security team

It was discovered that an unspecified race condition in the way objects were deserialized could allow an attacker to cause an applet or application to misuse the privileges of the user running the java applet or application.

Priority

Low

Status

Package Release Status
openjdk-6
Launchpad, Ubuntu, Debian
Upstream Needs triage

openjdk-6b18
Launchpad, Ubuntu, Debian
Upstream
Released (6b22)
sun-java6
Launchpad, Ubuntu, Debian
Upstream Needs triage

Notes

AuthorNote
sbeattie
red hat description: Race condition in the way objects
were deserialized could allow an untrusted applet or application to
misuse the privileges of the user running the applet or application.

References