// For flags

CVE-2011-0817

Oracle Java IE Browser Plugin Corrupted Window Procedure Hook Remote Code Execution Vulnerability

Severity Score

10.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, when running on Windows, allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

Vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Oracle Java SE 6 Update 25 y anteriores, cuando se ejecuta en Windows, permite a aplicaciones Java Web Start y Java applets no confiables afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con Deployment.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Oracle Sun Java Runtime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the JP2IEXP.dll browser plugin. The module creates a window hook when an applet is instantiated within the context of a browser. If the underlying DOM element is cloned and the parent object removed, a dangling reference can exist. When the module attempts to walk the relationship list to call the window hook, the process can be made to jump into uninitialized heap memory. This can be exploited by an attacker to execute code under the context of the user running the browser.

*Credits: Stephen Fewer of Harmony Security (www.harmonysecurity.com)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2011-02-04 CVE Reserved
  • 2011-06-08 CVE Published
  • 2023-10-21 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
<= 1.6.0
Search vendor "Sun" for product "Jdk" and version " <= 1.6.0"
update_25
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_10
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_11
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_12
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_13
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_14
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_15
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_16
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_17
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_18
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_19
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_20
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_21
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_22
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_23
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_24
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_3
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_4
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_5
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_6
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update_7
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update1
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jdk
Search vendor "Sun" for product "Jdk"
1.6.0
Search vendor "Sun" for product "Jdk" and version "1.6.0"
update2
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
<= 1.6.0
Search vendor "Sun" for product "Jre" and version " <= 1.6.0"
update_25
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_1
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_10
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_11
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_12
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_13
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_14
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_15
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_16
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_17
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_18
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_19
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_2
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_20
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_21
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_22
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_23
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_24
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_3
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_4
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_5
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_6
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_7
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
*-
Safe