CVE-2010-3555
Description
Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that the ActiveX Plugin does not properly initialize an object field that is used as a window handle, which allows attackers to execute arbitrary code.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Unspecified vulnerability in Oracle Java SE Deployment component allows remote attackers to execute arbitrary code via improper initialization in ActiveX plugin.
Vulnerability
CVE-2010-3555 is an unspecified vulnerability in the Deployment component of Oracle Java SE and Java for Business 6 Update 21 [2]. A reliable third-party coordinator reported that the ActiveX Plugin does not properly initialize an object field used as a window handle, leading to arbitrary code execution [2]. Affected versions include Oracle Java SE 6 Update 21 and earlier.
Exploitation
An attacker could exploit this vulnerability remotely via unknown vectors, likely by crafting a malicious web page that leverages the ActiveX plugin [2]. The exploit requires user interaction to load the malicious content in a browser with the vulnerable Java plugin enabled.
Impact
Successful exploitation could allow an attacker to execute arbitrary code on the affected system, compromising confidentiality, integrity, and availability [2]. The attacker gains the full privileges of the user running the browser.
Mitigation
Oracle released a Critical Patch Update in January 2011 that addresses this vulnerability [2]. Red Hat provided updates via RHSA-2010-0770 and RHSA-2010-0987 [3][4]. Avaya also issued an advisory recommending updates [2]. Organizations should apply the latest Oracle Java SE updates.
AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
43cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*+ 20 more
- cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:*:update_21:*:*:*:*:*:*range: <=1.6.0
cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*+ 19 more
- cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:*:update_21:*:*:*:*:*:*range: <=1.6.0
- Range: = 6 Update 21
- Range: = 6 Update 21
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
16- www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.htmlnvdPatchVendor Advisory
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jspnvd
- lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.htmlnvd
- marc.infonvd
- secunia.com/advisories/42974nvd
- secunia.com/advisories/44954nvd
- support.avaya.com/css/P8/documents/100114315nvd
- support.avaya.com/css/P8/documents/100123193nvd
- www.oracle.com/technetwork/topics/security/cpujan2011-194091.htmlnvd
- www.redhat.com/support/errata/RHSA-2010-0770.htmlnvd
- www.redhat.com/support/errata/RHSA-2010-0987.htmlnvd
- www.redhat.com/support/errata/RHSA-2011-0880.htmlnvd
- www.securityfocus.com/bid/44038nvd
- www.zerodayinitiative.com/advisories/ZDI-10-207/nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11320nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12222nvd
News mentions
0No linked articles in our index yet.