CVE-2010-3553

Publication date 19 October 2010

Last updated 24 July 2024

Unspecified vulnerability in the Swing component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to unsafe reflection involving the UIDefault.ProxyLazyValue class.

From the Ubuntu Security Team

It was discovered that UIDefault.ProxyLazyValue had unsafe reflection usage, allowing an attacker to create objects.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openjdk-6	10.10 maverick	Fixed 6b20-1.9.1-1ubuntu3
	10.04 LTS lucid	Fixed 1.8.2-4ubuntu2
	9.10 karmic	Fixed 1.8.2-4ubuntu1~9.10.1
	9.04 jaunty	Fixed 1.8.2-4ubuntu1~9.04.1
	8.04 LTS hardy	Fixed 1.8.2-4ubuntu1~8.04.1
	6.06 LTS dapper	Not in release
openjdk-6b18	10.10 maverick	Fixed 6b18-1.8.2-4ubuntu1
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
sun-java6	10.10 maverick	Fixed 6.22-0ubuntu1~10.10
	10.04 LTS lucid	Fixed 6.22-0ubuntu1~10.04
	9.10 karmic	Fixed 6.22-0ubuntu1~9.10.1
	9.04 jaunty	Fixed 6.22-0ubuntu1~9.04.1
	8.04 LTS hardy	Fixed 6.22-0ubuntu1~8.04.1
	6.06 LTS dapper	Not in release

Notes

sbeattie

red hat description: UIDefault.ProxyLazyValue had unsafe reflection usage, allowing untrusted callers to create objects via ProxyLazyValue values.

CVE-2010-3553

From the Ubuntu Security Team

Status

Notes

sbeattie

References

Related Ubuntu Security Notices (USN)

Other references