FKIE_CVE-2009-2674
Vulnerability from fkie_nvd - Published: 2009-08-05 19:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*",
"matchCriteriaId": "B8F93BBE-1E8C-4EB3-BCC7-20AB2D813F98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_1:*:*:*:*:*:*",
"matchCriteriaId": "9C9F6EA8-6A88-4485-89A3-0FDF84AB51DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_10:*:*:*:*:*:*",
"matchCriteriaId": "D7680A8A-EC07-4819-A93C-B8EBF8B1199F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_11:*:*:*:*:*:*",
"matchCriteriaId": "FA89349B-834C-42D0-84C6-CA73CE1F8B26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_12:*:*:*:*:*:*",
"matchCriteriaId": "B7865369-9DE6-4C20-ACD2-CCC14ED54701",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_13:*:*:*:*:*:*",
"matchCriteriaId": "8614E7A0-091C-4080-89FA-B2C7609B4AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_2:*:*:*:*:*:*",
"matchCriteriaId": "67E0818A-3675-4293-89FE-5001E36C0F38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_3:*:*:*:*:*:*",
"matchCriteriaId": "95112B98-B6B2-43FA-BF76-F518649CF3BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_4:*:*:*:*:*:*",
"matchCriteriaId": "3A18341A-3688-48E7-95AD-283EC9C95B4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_5:*:*:*:*:*:*",
"matchCriteriaId": "E301C59A-47F5-4861-9091-D0002CBA5B7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_6:*:*:*:*:*:*",
"matchCriteriaId": "BCD4F889-710C-43C5-85DD-70E96F8FE313",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_7:*:*:*:*:*:*",
"matchCriteriaId": "ED195051-AAC7-4EE1-B936-18D1C8AD2498",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_8:*:*:*:*:*:*",
"matchCriteriaId": "44146DF6-F368-4F17-B379-34194873D80F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jdk:6:update_9:*:*:*:*:*:*",
"matchCriteriaId": "18B70D77-F631-47D8-95A5-1D3A7E8BF63B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_1:*:*:*:*:*:*",
"matchCriteriaId": "0F98D2BD-2AC1-4C4C-8A10-71093DCBC4E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_10:*:*:*:*:*:*",
"matchCriteriaId": "2D6FCAFC-F41C-4C6F-9EA4-46AEFF65CC5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_11:*:*:*:*:*:*",
"matchCriteriaId": "8BA9E6CD-F43F-487D-9638-406B72D51471",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_12:*:*:*:*:*:*",
"matchCriteriaId": "9D2F4664-E158-45ED-81B6-D8371F1C6B9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_13:*:*:*:*:*:*",
"matchCriteriaId": "26826BB7-0EF6-439B-87F4-5BCCEA3A8907",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_2:*:*:*:*:*:*",
"matchCriteriaId": "CDC09958-5286-4C16-AB6F-63B4BDD902B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_3:*:*:*:*:*:*",
"matchCriteriaId": "BDE1E9E9-85EF-4ACA-902B-00225EB4324F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_4:*:*:*:*:*:*",
"matchCriteriaId": "E0CDBFCB-42EA-4F19-A98D-7696B0D526CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_5:*:*:*:*:*:*",
"matchCriteriaId": "53DCFF2A-77A7-41DB-A712-9B6D1FD2574A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_6:*:*:*:*:*:*",
"matchCriteriaId": "82C6F76F-68FD-4794-9182-935D85910C1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_7:*:*:*:*:*:*",
"matchCriteriaId": "6314C9DF-9421-445D-ABCC-79EDCED23156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_8:*:*:*:*:*:*",
"matchCriteriaId": "533670FA-B8DC-40B4-ADC1-CCD70E4A43A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun:jre:6:update_9:*:*:*:*:*:*",
"matchCriteriaId": "119B72FA-8B85-4D1F-8A14-5B07204DAED5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow."
},
{
"lang": "es",
"value": "Un desbordamiento de enteros en el archivo javaws.exe en Sun Java Web Start en Sun Java Runtime Environment (JRE) en JDK y JRE versi\u00f3n 6 anterior a Update 15, permite a los atacantes dependiendo del contexto ejecutar c\u00f3digo arbitrario por medio de una imagen JPEG creada que no se maneja apropiadamente durante la visualizaci\u00f3n de una imagen de bienvenida, que desencadena un desbordamiento de b\u00fafer basado en la regi\u00f3n heap de la memoria."
}
],
"id": "CVE-2009-2674",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-08-05T19:30:01.267",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/36162"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/36176"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/36180"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/36248"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37300"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37386"
},
{
"source": "cve@mitre.org",
"url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263428-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
},
{
"source": "cve@mitre.org",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
},
{
"source": "cve@mitre.org",
"tags": [
"US Government Resource"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/2543"
},
{
"source": "cve@mitre.org",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-09-050/"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52339"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10073"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8073"
},
{
"source": "cve@mitre.org",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
},
{
"source": "cve@mitre.org",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/36162"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/36176"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/36180"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/36248"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37300"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37386"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263428-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"US Government Resource"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/2543"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-09-050/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52339"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10073"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8073"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…