dbcve.org
JreApplication · Sun

CVE-2010-4465

HIGH · 10.0 CVSS v2.0 Published 2011-02-17
Fix available
A fix is available. Upgrade to after 1.6.0 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Swing. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is related to the lack of framework support by AWT event dispatch, and/or "clipboard access in Applets."

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis

A detailed technical summary for this CVE is being prepared.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
JreApplication
Affected:<= 1.6.0= 1.6.0<= 1.5.0= 1.5.0<= 1.4.2_29= 1.4.2= 1.4.2_1= 1.4.2_2= 1.4.2_3= 1.4.2_4= 1.4.2_5= 1.4.2_6
JdkApplication
Affected:<= 1.6.0= 1.6.0<= 1.5.0= 1.5.0
SdkApplication
Affected:<= 1.4.2_29= 1.4.2= 1.4.2_1= 1.4.2_02= 1.4.2_3= 1.4.2_4= 1.4.2_5= 1.4.2_6= 1.4.2_7= 1.4.2_8= 1.4.2_9= 1.4.2_10

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 1.6.0
Vendor patch www.oracle.com →
Recommended fix High confidence

Java 6 Update 24+ (or Java 7/8 LTS for long-term support)

  1. 1. Identify all systems running affected Java versions (JDK/JRE 1.4.2_29 and earlier, 5.0 Update 27 and earlier, 6 Update 23 and earlier)
  2. 2. Download the latest Oracle JDK/JRE from https://www.oracle.com/java/technologies/downloads/
  3. 3. For Java 6 Update 23 and earlier: upgrade to Java 6 Update 24 or later
  4. 4. For Java 5.0 Update 27 and earlier: upgrade to Java 5.0 Update 28 or later (or migrate to a newer Java version)
  5. 5. For Java 1.4.2_29 and earlier: this version is end-of-life; migrate to a supported Java version (6, 7, or 8)
  6. 6. Verify the new Java version by running 'java -version'
  7. 7. Update any application configurations or PATH variables to point to the new Java installation
  8. 8. Test that Java-dependent applications function correctly with the new version
Caveat Applications compiled for older Java versions should run on newer versions, but some may require recompilation or configuration changes; verify application compatibility before deploying to production

Generated from the published advisory — verify against the referenced sources before acting.

We can identify the exact fixed release, upgrade, and verify it in staging — typical engagement from $1,950. Get the upgrade done

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2010-4465 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2010-4465 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data