This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.
Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow using an untrusted size value in the readMabCurveData function in the CMM module in the JVM.
'Affected product releases and versions:
• Java SE:
• JDK and JRE 6 Update 18 and earlier for Windows, Solaris, and Linux
• JDK 5.0 Update 23 and earlier for Solaris
• SDK 1.4.2_25 and earlier for Solaris
• Java for Business:
• JDK and JRE 6 Update 18 and earlier for Windows, Solaris and Linux
• JDK and JRE 5.0 Update 23 and earlier for Windows, Solaris and Linux
• SDK and JRE 1.4.2_25 and earlier for Windows, Solaris and Linux'
CVSS v2.0 Severity and Metrics:
Access Vector (AV):
Access Complexity (AC):
Allows unauthorized disclosure of information
Allows unauthorized modification
Allows disruption of service