CVE-2010-0538

Apple Java for Mac OS X 10.5 before Update 7 and Java for Mac OS X 10.6 before Update 2 do not properly handle mediaLibImage objects, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted applet, related to the com.sun.medialib.mlib package.

• CWE-399

• http://lists.apple.com/archives/security-announce/2010//May/msg00001.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//May/msg00002.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/39819Vendor Advisory
• http://securitytracker.com/id?1024011
• http://support.apple.com/kb/HT4170Patch, Vendor Advisory
• http://support.apple.com/kb/HT4171Patch, Vendor Advisory
• http://www.securityfocus.com/bid/40238Patch
• http://www.vupen.com/english/advisories/2010/1191Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//May/msg00001.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//May/msg00002.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/39819Vendor Advisory
• http://securitytracker.com/id?1024011
• http://support.apple.com/kb/HT4170Patch, Vendor Advisory
• http://support.apple.com/kb/HT4171Patch, Vendor Advisory
• http://www.securityfocus.com/bid/40238Patch
• http://www.vupen.com/english/advisories/2010/1191Vendor Advisory

Published

May 21, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-0532Race condition in the installation package in Apple iTunes b…
• CVE-2010-0533Directory traversal vulnerability in AFP Server in Apple Mac…
• CVE-2010-0534Wiki Server in Apple Mac OS X 10.6 before 10.6.3 does not en…
• CVE-2010-0535Dovecot in Apple Mac OS X 10.6 before 10.6.3, when Kerberos …
• CVE-2010-0536Apple QuickTime before 7.6.6 on Windows allows remote attack…
• CVE-2010-0537DesktopServices in Apple Mac OS X 10.6 before 10.6.3 does no…
• CVE-2010-0539Integer signedness error in the window drawing implementatio…
• CVE-2010-0540Cross-site request forgery (CSRF) vulnerability in the web i…
• CVE-2010-0541Cross-site scripting (XSS) vulnerability in the WEBrick HTTP…
• CVE-2010-0542The _WriteProlog function in texttops.c in texttops in the T…
• CVE-2010-0543ImageIO in Apple Mac OS X 10.5.8, and 10.6 before 10.6.2, al…
• CVE-2010-0544Cross-site scripting (XSS) vulnerability in WebKit in Apple …