Cyber Resilience

CVE-2010-0840

Canonical Ubuntu Linux 8.04 … 9.10

CISA KEVActive ExploitationEUVD Exploited
Published
01 April 2010
Modified
21 April 2026
KEV Added
25 May 2022
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.96 99.9th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2010-0840 is a critical-severity an unspecified weakness vulnerability in Canonical Ubuntu Linux. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

EU & UK References

Vulnerability Data

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information…

more

was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

CWE(s)
NVD-CWE-noinfo
KEV Date Added
25 May 2022

Related Threats

Threat-Actor AttributionAI

NEODYMIUM (G0055)
Microsoft Security Intelligence Report Volume 21 | January through June, 2016 This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. This docu
PROMETHIUM (G0056)
Microsoft Security Intelligence Report Volume 21 | January through June, 2016 This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. This docu

CVEs Like This One

CVE-2013-2423Same product: Canonical Ubuntu Linuxboth on KEV
CVE-2013-0422Same product: Canonical Ubuntu Linuxboth on KEV
CVE-2010-4344Same product: Canonical Ubuntu Linuxboth on KEV
CVE-2010-4345Same product: Canonical Ubuntu Linuxboth on KEV
CVE-2011-3544Same product: Canonical Ubuntu Linuxboth on KEV
CVE-2021-3493Same product: Canonical Ubuntu Linuxboth on KEV
CVE-2014-3153Same product: Canonical Ubuntu Linuxboth on KEV
CVE-2016-3714Same product: Canonical Ubuntu Linuxboth on KEV
CVE-2015-2590Same product: Canonical Ubuntu Linuxboth on KEV
CVE-2013-0431Same product: Oracle Jreboth on KEV

Affected Assets

oracle
jre
1.4.2_25, 1.5.0, 1.6.0
opensuse
opensuse
11.0, 11.1, 11.2
canonical
ubuntu linux
8.04, 8.10, 9.04, 9.10

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References