CVE-2010-3571

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-10-19 · updated 2026-06-16

Description

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the color profile parser that allows remote attackers to execute arbitrary code via a crafted Tag structure in a color profile.

Affected products

Sun Jdk: through 1.6.0; through 1.5.0; through 1.3.1_28; 1.6.0, 1.6.0-update_10, 1.6.0-update_11, 1.6.0-update_12, 1.6.0-update_13, 1.6.0-update_14 (+74)
Sun Jre: through 1.6.0; through 1.5.0; through 1.4.2_27; through 1.3.1_28; 1.6.0, 1.6.0-update_1, 1.6.0-update_10, 1.6.0-update_11, 1.6.0-update_12, 1.6.0-update_13 (+100)
Sun Sdk: through 1.4.2_27; through 1.3.1_28; 1.4.2, 1.4.2_1, 1.4.2_02, 1.4.2_3, 1.4.2_4, 1.4.2_5 (+56)

References

Get alerted when CVE-2010-3571 or the next vulnerability affects your stack