CVE-2010-0842

EXPLOITED

Oracle Java SE/JFB - Unspecified Vuln

Title source: llm

Description

Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object, related to the GM_Song structure.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/18485
metasploit WORKING POC GREAT
by Peter Vreugdenhil, juan vazquez · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_mixer_sequencer.rb

Scores

EPSS 0.8433
EPSS Percentile 99.3%

Details

VulnCheck KEV 2012-01-14
Status published
Products (13)
sun/jdk 1.6.0 (17 CPE variants)
sun/jdk 1.5.0 (22 CPE variants)
sun/jdk 1.3.0
sun/jdk 1.3.0_01
sun/jdk 1.3.0_02
sun/jdk 1.3.0_03
sun/jdk 1.3.0_04
sun/jdk 1.3.0_05
sun/jdk 1.3.1
sun/jdk 1.3.1_01
... and 3 more
Published Apr 01, 2010
Tracked Since Feb 18, 2026