Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Oracle Java image handling can run malicious code

CVE-2010-0841 · published 16 years ago
Summary

A weakness in the part of Oracle Java that reads JPEG pictures could let a remote attacker run their own programs on a vulnerable computer, potentially stealing or damaging data. The problem exists in older Java versions used for desktop and business applications. Update Java to the latest release and avoid opening JPEG files from untrusted sources.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sun jre <= 1.6.0
1.6.0
<= 1.5.0
1.5.0
<= 1.4.2_25
1.4.2
1.4.2_1
1.4.2_2
1.4.2_3
1.4.2_4
1.4.2_5
1.4.2_6
18 more version ranges
cpe:2.3:a:sun:jre:*:update_18:*:*:*:*:*:*
sun jdk <= 1.6.0
1.6.0
<= 1.5.0
1.5.0
cpe:2.3:a:sun:jdk:*:update_18:*:*:*:*:*:*
sun sdk <= 1.4.2_25
1.4.2
1.4.2_1
1.4.2_02
1.4.2_3
1.4.2_4
1.4.2_5
1.4.2_6
1.4.2_7
1.4.2_8
1.4.2_9
1.4.2_10
14 more version ranges
cpe:2.3:a:sun:sdk:*:*:*:*:*:*:*:*
Original advisory text
Unspecified vulnerability in the ImageIO component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and...
Unspecified vulnerability in the ImageIO component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the Java Runtime Environment that allows remote attackers to execute arbitrary code via a JPEG image that contains subsample dimensions with large values, related to JPEGImageReader and "stepX".
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
6% chance of attack within 30 days
Timeline
Published1 Apr 2010
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2010-0841 · NVD
Track software like this
Free during beta