CVE-2010-4467: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 U...

Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 10 through 6 Update 23 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 7, 2024, 03:43 UTC (UTC+00:00)

Analyst readout for executives and security teams

Plain-English summary

This CVE affects legacy Oracle Java 6 runtime deployments. A malicious untrusted Java Web Start application or applet could affect confidentiality, integrity, and availability through an unspecified Deployment component flaw. The public details are sparse, but the business issue is clear: old Java 6 client runtimes create browser and Web Start exposure that should be removed or updated.

Executive priority

Prioritize cleanup if legacy Java 6 exists in the environment. The vulnerability is old, but the affected runtime is obsolete and broad CIA impact is listed. Treat confirmed exposure as a modernization and risk-reduction item rather than waiting for exploit intelligence.

Technical view

CVE-2010-4467 is an unspecified Oracle JRE Deployment vulnerability in Oracle Java SE and Java for Business 6 Update 10 through Update 23. The source bundle does not provide CVSS, CWE, root cause, or exploit mechanics. References include Oracle’s February 2011 Java CPU and downstream Linux vendor advisories.

Likely exposure

Exposure is most likely on endpoints or servers retaining Oracle Java 6 Update 10 through Update 23, especially where Java browser applets or Java Web Start remain enabled. Modern systems without Java 6 or without these client execution paths are less likely exposed.

Exploitation context

The bundle supports remote attack through untrusted Java Web Start applications and applets. It does not show CISA KEV listing, confirmed active exploitation, public exploit details, or a specific exploitation prerequisite beyond the Java client attack surface.

Researcher notes

The public record is thin: no CVSS, CWE, or root-cause details are included in the bundle. IBM’s reference label suggests code execution, but the CVE description only states CIA impact through unknown Deployment vectors. Avoid over-scoping beyond Java 6 Update 10 through Update 23.

Mitigation direction

Inventory and remove Oracle Java 6 Update 10 through Update 23.
Apply Oracle or OS vendor Java security updates where Java is still required.
Disable Java browser applets and Java Web Start where business permits.
Retire unsupported Java 6 runtimes from managed endpoint baselines.
Review Oracle, Red Hat, Gentoo, and HP advisories for platform-specific guidance.

Validation and detection

Confirm installed Java versions across endpoints and servers.
Check browsers and desktop policies for Java applet or Web Start enablement.
Verify vendor-patched Java packages are deployed where Java remains required.
Use OVAL definitions where applicable for configuration-based detection.
Document exceptions for any business-critical legacy Java dependency.

Prepared: Jun 27, 2026, 18:32 UTC (UTC+00:00)
Confidence: medium
Sources: 10

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2010-4467 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Feb 17, 2011, 18:31 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

12Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
GLSA-201406-32CVE reference · vendor-advisory, x_refsource_GENTOO
oracle-runtime-deployment-code-exec(65398)CVE reference · vdb-entry, x_refsource_XF
HPSBMU02799CVE reference · vendor-advisory, x_refsource_HP
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.htmlCVE reference · x_refsource_CONFIRM
44954CVE reference · third-party-advisory, x_refsource_SECUNIA
RHSA-2011:0880CVE reference · vendor-advisory, x_refsource_REDHAT
46395CVE reference · vdb-entry, x_refsource_BID
RHSA-2011:0282CVE reference · vendor-advisory, x_refsource_REDHAT
oval:org.mitre.oval:def:14384CVE reference · vdb-entry, signature
SSRT100867CVE reference · vendor-advisory, x_refsource_HP
oval:org.mitre.oval:def:12269CVE reference · vdb-entry, signature

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.