csaf_redhat - rhsa-2009

rhsa-2009_1201

Vulnerability from csaf_redhat

Published

2009-08-06 21:14

Modified

2024-11-05 17:07

Summary

Red Hat Security Advisory: java-1.6.0-openjdk security and bug fix update

Notes

Topic

Updated java-1.6.0-openjdk packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

Details

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language. A flaw was found in the way the XML Digital Signature implementation in the JRE handled HMAC-based XML signatures. An attacker could use this flaw to create a crafted signature that could allow them to bypass authentication, or trick a user, applet, or application into accepting untrusted content. (CVE-2009-0217) Several potential information leaks were found in various mutable static variables. These could be exploited in application scenarios that execute untrusted scripting code. (CVE-2009-2475) It was discovered that OpenType checks can be bypassed. This could allow a rogue application to bypass access restrictions by acquiring references to privileged objects through finalizer resurrection. (CVE-2009-2476) A denial of service flaw was found in the way the JRE processes XML. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service. (CVE-2009-2625) A flaw was found in the JRE audio system. An untrusted applet or application could use this flaw to gain read access to restricted System properties. (CVE-2009-2670) Two flaws were found in the JRE proxy implementation. An untrusted applet or application could use these flaws to discover the usernames of users running applets and applications, or obtain web browser cookies and use them for session hijacking attacks. (CVE-2009-2671, CVE-2009-2672) An additional flaw was found in the proxy mechanism implementation. This flaw allowed an untrusted applet or application to bypass access restrictions and communicate using non-authorized socket or URL connections to hosts other than the origin host. (CVE-2009-2673) An integer overflow flaw was found in the way the JRE processes JPEG images. An untrusted application could use this flaw to extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the application. (CVE-2009-2674) An integer overflow flaw was found in the JRE unpack200 functionality. An untrusted applet or application could extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the applet or application. (CVE-2009-2675) It was discovered that JDK13Services grants unnecessary privileges to certain object types. This could be misused by an untrusted applet or application to use otherwise restricted functionality. (CVE-2009-2689) An information disclosure flaw was found in the way private Java variables were handled. An untrusted applet or application could use this flaw to obtain information from variables that would otherwise be private. (CVE-2009-2690) Note: The flaws concerning applets in this advisory, CVE-2009-2475, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2689, and CVE-2009-2690, can only be triggered in java-1.6.0-openjdk by calling the "appletviewer" application. This update also fixes the following bug: * the EVR in the java-1.6.0-openjdk package as shipped with Red Hat Enterprise Linux allowed the java-1.6.0-openjdk package from the EPEL repository to take precedence (appear newer). Users using java-1.6.0-openjdk from EPEL would not have received security updates since October 2008. This update prevents the packages from EPEL from taking precedence. (BZ#499079) All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated java-1.6.0-openjdk packages that fix several security issues and a\nbug are now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having important security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "These packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE)\ncontains the software and tools that users need to run applications written\nusing the Java programming language.\n\nA flaw was found in the way the XML Digital Signature implementation in the\nJRE handled HMAC-based XML signatures. An attacker could use this flaw to\ncreate a crafted signature that could allow them to bypass authentication,\nor trick a user, applet, or application into accepting untrusted content.\n(CVE-2009-0217)\n\nSeveral potential information leaks were found in various mutable static\nvariables. These could be exploited in application scenarios that execute\nuntrusted scripting code. (CVE-2009-2475)\n\nIt was discovered that OpenType checks can be bypassed. This could allow a\nrogue application to bypass access restrictions by acquiring references to\nprivileged objects through finalizer resurrection. (CVE-2009-2476)\n\nA denial of service flaw was found in the way the JRE processes XML. A\nremote attacker could use this flaw to supply crafted XML that would lead\nto a denial of service. (CVE-2009-2625)\n\nA flaw was found in the JRE audio system. An untrusted applet or\napplication could use this flaw to gain read access to restricted System\nproperties. (CVE-2009-2670)\n\nTwo flaws were found in the JRE proxy implementation. An untrusted applet\nor application could use these flaws to discover the usernames of users\nrunning applets and applications, or obtain web browser cookies and use\nthem for session hijacking attacks. (CVE-2009-2671, CVE-2009-2672)\n\nAn additional flaw was found in the proxy mechanism implementation. This\nflaw allowed an untrusted applet or application to bypass access\nrestrictions and communicate using non-authorized socket or URL connections\nto hosts other than the origin host. (CVE-2009-2673) \n\nAn integer overflow flaw was found in the way the JRE processes JPEG\nimages. An untrusted application could use this flaw to extend its\nprivileges, allowing it to read and write local files, as well as to\nexecute local applications with the privileges of the user running the\napplication. (CVE-2009-2674)\n\nAn integer overflow flaw was found in the JRE unpack200 functionality. An\nuntrusted applet or application could extend its privileges, allowing it to\nread and write local files, as well as to execute local applications with\nthe privileges of the user running the applet or application. (CVE-2009-2675)\n\nIt was discovered that JDK13Services grants unnecessary privileges to\ncertain object types. This could be misused by an untrusted applet or\napplication to use otherwise restricted functionality. (CVE-2009-2689)\n\nAn information disclosure flaw was found in the way private Java variables\nwere handled. An untrusted applet or application could use this flaw to\nobtain information from variables that would otherwise be private.\n(CVE-2009-2690)\n\nNote: The flaws concerning applets in this advisory, CVE-2009-2475,\nCVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2675,\nCVE-2009-2689, and CVE-2009-2690, can only be triggered in\njava-1.6.0-openjdk by calling the \"appletviewer\" application.\n\nThis update also fixes the following bug:\n\n* the EVR in the java-1.6.0-openjdk package as shipped with Red Hat\nEnterprise Linux allowed the java-1.6.0-openjdk package from the EPEL\nrepository to take precedence (appear newer). Users using\njava-1.6.0-openjdk from EPEL would not have received security updates since\nOctober 2008. This update prevents the packages from EPEL from taking\nprecedence. (BZ#499079)\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2009:1201",
        "url": "https://access.redhat.com/errata/RHSA-2009:1201"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://blogs.sun.com/security/entry/advance_notification_of_security_updates5",
        "url": "http://blogs.sun.com/security/entry/advance_notification_of_security_updates5"
      },
      {
        "category": "external",
        "summary": "499079",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=499079"
      },
      {
        "category": "external",
        "summary": "511915",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
      },
      {
        "category": "external",
        "summary": "512896",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512896"
      },
      {
        "category": "external",
        "summary": "512907",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512907"
      },
      {
        "category": "external",
        "summary": "512914",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512914"
      },
      {
        "category": "external",
        "summary": "512915",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512915"
      },
      {
        "category": "external",
        "summary": "512920",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512920"
      },
      {
        "category": "external",
        "summary": "512921",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512921"
      },
      {
        "category": "external",
        "summary": "513215",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513215"
      },
      {
        "category": "external",
        "summary": "513220",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513220"
      },
      {
        "category": "external",
        "summary": "513222",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513222"
      },
      {
        "category": "external",
        "summary": "513223",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513223"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1201.json"
      }
    ],
    "title": "Red Hat Security Advisory: java-1.6.0-openjdk security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-05T17:07:28+00:00",
      "generator": {
        "date": "2024-11-05T17:07:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2009:1201",
      "initial_release_date": "2009-08-06T21:14:00+00:00",
      "revision_history": [
        {
          "date": "2009-08-06T21:14:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2009-08-06T17:14:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T17:07:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
                  "product_id": "5Client",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux (v. 5 server)",
                "product": {
                  "name": "Red Hat Enterprise Linux (v. 5 server)",
                  "product_id": "5Server",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
                "product": {
                  "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_id": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-debuginfo@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
                "product": {
                  "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_id": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-javadoc@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
                "product": {
                  "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_id": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-src@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
                "product": {
                  "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_id": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-demo@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
                "product": {
                  "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_id": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-devel@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
                "product": {
                  "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_id": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
                "product": {
                  "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_id": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-debuginfo@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
                "product": {
                  "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_id": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-javadoc@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
                "product": {
                  "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_id": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-src@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
                "product": {
                  "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_id": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-demo@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
                "product": {
                  "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_id": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-devel@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
                "product": {
                  "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_id": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
                "product": {
                  "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
                  "product_id": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-1.6.0-openjdk@1.6.0.0-1.2.b09.el5?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src"
        },
        "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src"
        },
        "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386"
        },
        "product_reference": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        },
        "product_reference": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
        "relates_to_product_reference": "5Server"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2009-0217",
      "discovery_date": "2009-07-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "511915"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-0217"
        },
        {
          "category": "external",
          "summary": "RHBZ#511915",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-0217",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-0217"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0217",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0217"
        }
      ],
      "release_date": "2009-07-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass"
    },
    {
      "cve": "CVE-2009-2475",
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "513215"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,6660049,6660539,6813167)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2475"
        },
        {
          "category": "external",
          "summary": "RHBZ#513215",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513215"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2475",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2475"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2475",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2475"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,6660049,6660539,6813167)"
    },
    {
      "cve": "CVE-2009-2476",
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "513220"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK OpenType checks can be bypassed (6736293)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2476"
        },
        {
          "category": "external",
          "summary": "RHBZ#513220",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513220"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2476",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2476"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2476",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2476"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "OpenJDK OpenType checks can be bypassed (6736293)"
    },
    {
      "cve": "CVE-2009-2625",
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "512921"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JDK: XML parsing Denial-Of-Service (6845701)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2625"
        },
        {
          "category": "external",
          "summary": "RHBZ#512921",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512921"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2625",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2625"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2625",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2625"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "JDK: XML parsing Denial-Of-Service (6845701)"
    },
    {
      "cve": "CVE-2009-2670",
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "512896"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK Untrusted applet System properties access (6738524)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2670"
        },
        {
          "category": "external",
          "summary": "RHBZ#512896",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512896"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2670",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2670"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2670",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2670"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "OpenJDK Untrusted applet System properties access (6738524)"
    },
    {
      "cve": "CVE-2009-2671",
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "512907"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK Proxy mechanism information leaks  (6801071)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2671"
        },
        {
          "category": "external",
          "summary": "RHBZ#512907",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512907"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2671",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2671"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2671",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2671"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "OpenJDK Proxy mechanism information leaks  (6801071)"
    },
    {
      "cve": "CVE-2009-2672",
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "512907"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK Proxy mechanism information leaks  (6801071)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2672"
        },
        {
          "category": "external",
          "summary": "RHBZ#512907",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512907"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2672",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2672"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2672",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2672"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "OpenJDK Proxy mechanism information leaks  (6801071)"
    },
    {
      "cve": "CVE-2009-2673",
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "512914"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK proxy mechanism allows non-authorized socket connections  (6801497)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2673"
        },
        {
          "category": "external",
          "summary": "RHBZ#512914",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512914"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2673",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2673"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2673",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2673"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "OpenJDK proxy mechanism allows non-authorized socket connections  (6801497)"
    },
    {
      "cve": "CVE-2009-2674",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "512915"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Java Web Start Buffer JPEG processing integer overflow (6823373)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2674"
        },
        {
          "category": "external",
          "summary": "RHBZ#512915",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512915"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2674",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2674"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2674",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2674"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "Java Web Start Buffer JPEG processing integer overflow (6823373)"
    },
    {
      "cve": "CVE-2009-2675",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "512920"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Java Web Start Buffer unpack200 processing integer overflow (6830335)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2675"
        },
        {
          "category": "external",
          "summary": "RHBZ#512920",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512920"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2675",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2675"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2675",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2675"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "Java Web Start Buffer unpack200 processing integer overflow (6830335)"
    },
    {
      "cve": "CVE-2009-2689",
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "513222"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK JDK13Services grants unnecessary privileges  (6777448)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2689"
        },
        {
          "category": "external",
          "summary": "RHBZ#513222",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513222"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2689",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2689"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2689",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2689"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "OpenJDK JDK13Services grants unnecessary privileges  (6777448)"
    },
    {
      "cve": "CVE-2009-2690",
      "discovery_date": "2009-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "513223"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK private variable information disclosure (6777487)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
          "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
          "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-2690"
        },
        {
          "category": "external",
          "summary": "RHBZ#513223",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513223"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2690",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-2690"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2690",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2690"
        }
      ],
      "release_date": "2009-08-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-08-06T21:14:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1201"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src",
            "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386",
            "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "OpenJDK private variable information disclosure (6777487)"
    }
  ]
}

cve-2009-2625

Vulnerability from cvelistv5

Published

2009-08-06 15:00

Modified

2024-08-07 05:59

Severity ?

Summary

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

References

▼	URL	Tags
	http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026	vendor-advisory, x_refsource_SLACKWARE
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	https://rhn.redhat.com/errata/RHSA-2009-1199.html	vendor-advisory, x_refsource_REDHAT
	http://www.networkworld.com/columnists/2009/080509-xml-flaw.html	x_refsource_MISC
	http://www.ubuntu.com/usn/USN-890-1	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	http://www.debian.org/security/2010/dsa-1984	vendor-advisory, x_refsource_DEBIAN
	http://www.openwall.com/lists/oss-security/2009/10/22/9	mailing-list, x_refsource_MLIST
	http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1	vendor-advisory, x_refsource_SUNALERT
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://www.redhat.com/support/errata/RHSA-2009-1615.html	vendor-advisory, x_refsource_REDHAT
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/37754	third-party-advisory, x_refsource_SECUNIA
	https://rhn.redhat.com/errata/RHSA-2009-1637.html	vendor-advisory, x_refsource_REDHAT
	http://www.cert.fi/en/reports/2009/vulnerability2009085.html	x_refsource_MISC
	http://www.codenomicon.com/labs/xml/	x_refsource_MISC
	http://secunia.com/advisories/36199	third-party-advisory, x_refsource_SECUNIA
	http://rhn.redhat.com/errata/RHSA-2012-1537.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	http://www.redhat.com/support/errata/RHSA-2011-0858.html	vendor-advisory, x_refsource_REDHAT
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://www.securitytracker.com/id?1022680	vdb-entry, x_refsource_SECTRACK
	http://secunia.com/advisories/37671	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/38342	third-party-advisory, x_refsource_SECUNIA
	https://rhn.redhat.com/errata/RHSA-2009-1636.html	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/35958	vdb-entry, x_refsource_BID
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	https://rhn.redhat.com/errata/RHSA-2009-1649.html	vendor-advisory, x_refsource_REDHAT
	http://www.openwall.com/lists/oss-security/2009/10/26/3	mailing-list, x_refsource_MLIST
	http://www.us-cert.gov/cas/techalerts/TA09-294A.html	third-party-advisory, x_refsource_CERT
	http://secunia.com/advisories/50549	third-party-advisory, x_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/38231	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1	vendor-advisory, x_refsource_SUNALERT
	http://www.mandriva.com/security/advisories?name=MDVSA-2011:108	vendor-advisory, x_refsource_MANDRIVA
	http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html	x_refsource_CONFIRM
	http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1	x_refsource_CONFIRM
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/43300	third-party-advisory, x_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356	vdb-entry, signature, x_refsource_OVAL
	http://www.us-cert.gov/cas/techalerts/TA10-012A.html	third-party-advisory, x_refsource_CERT
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://rhn.redhat.com/errata/RHSA-2012-1232.html	vendor-advisory, x_refsource_REDHAT
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1	vendor-advisory, x_refsource_SUNALERT
	http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h	x_refsource_CONFIRM
	http://secunia.com/advisories/37300	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.redhat.com/show_bug.cgi?id=512921	x_refsource_CONFIRM
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html	vendor-advisory, x_refsource_SUSE
	http://www.openwall.com/lists/oss-security/2009/09/06/1	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2009/10/23/6	mailing-list, x_refsource_MLIST
	http://www.vupen.com/english/advisories/2011/0359	vdb-entry, x_refsource_VUPEN
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN
	https://rhn.redhat.com/errata/RHSA-2009-1650.html	vendor-advisory, x_refsource_REDHAT
	https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:56.314Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SSA:2011-041-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2011\u0026m=slackware-security.486026"
          },
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "RHSA-2009:1199",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.networkworld.com/columnists/2009/080509-xml-flaw.html"
          },
          {
            "name": "USN-890-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-890-1"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "DSA-1984",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2010/dsa-1984"
          },
          {
            "name": "[oss-security] 20091022 Re: Regarding expat bug 1990430",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2009/10/22/9"
          },
          {
            "name": "1021506",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "RHSA-2009:1615",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-1615.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "HPSBUX02476",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "37754",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37754"
          },
          {
            "name": "RHSA-2009:1637",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.cert.fi/en/reports/2009/vulnerability2009085.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.codenomicon.com/labs/xml/"
          },
          {
            "name": "36199",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36199"
          },
          {
            "name": "RHSA-2012:1537",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1537.html"
          },
          {
            "name": "SUSE-SR:2010:013",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "name": "RHSA-2011:0858",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2011-0858.html"
          },
          {
            "name": "SSRT090250",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "1022680",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022680"
          },
          {
            "name": "37671",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37671"
          },
          {
            "name": "38342",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38342"
          },
          {
            "name": "RHSA-2009:1636",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
          },
          {
            "name": "35958",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35958"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "RHSA-2009:1649",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
          },
          {
            "name": "[oss-security] 20091026 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2009/10/26/3"
          },
          {
            "name": "TA09-294A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
          },
          {
            "name": "50549",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50549"
          },
          {
            "name": "oval:org.mitre.oval:def:8520",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "name": "38231",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38231"
          },
          {
            "name": "272209",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1"
          },
          {
            "name": "MDVSA-2011:108",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:108"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "name": "43300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43300"
          },
          {
            "name": "oval:org.mitre.oval:def:9356",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356"
          },
          {
            "name": "TA10-012A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA10-012A.html"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "RHSA-2012:1232",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1232.html"
          },
          {
            "name": "263489",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055\u0026r2=787352\u0026pathrev=787353\u0026diff_format=h"
          },
          {
            "name": "37300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37300"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "SUSE-SA:2009:053",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512921"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "SUSE-SR:2009:017",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
          },
          {
            "name": "[oss-security] 20090906 Re: Re: expat bug 1990430",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2009/09/06/1"
          },
          {
            "name": "[oss-security] 20091023 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2009/10/23/6"
          },
          {
            "name": "ADV-2011-0359",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0359"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          },
          {
            "name": "RHSA-2009:1650",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
          },
          {
            "name": "[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-20T16:06:10",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "name": "SSA:2011-041-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2011\u0026m=slackware-security.486026"
        },
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "RHSA-2009:1199",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.networkworld.com/columnists/2009/080509-xml-flaw.html"
        },
        {
          "name": "USN-890-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-890-1"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "DSA-1984",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2010/dsa-1984"
        },
        {
          "name": "[oss-security] 20091022 Re: Regarding expat bug 1990430",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2009/10/22/9"
        },
        {
          "name": "1021506",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "RHSA-2009:1615",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-1615.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "HPSBUX02476",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "37754",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37754"
        },
        {
          "name": "RHSA-2009:1637",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.cert.fi/en/reports/2009/vulnerability2009085.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.codenomicon.com/labs/xml/"
        },
        {
          "name": "36199",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36199"
        },
        {
          "name": "RHSA-2012:1537",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1537.html"
        },
        {
          "name": "SUSE-SR:2010:013",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "name": "RHSA-2011:0858",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2011-0858.html"
        },
        {
          "name": "SSRT090250",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "1022680",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022680"
        },
        {
          "name": "37671",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37671"
        },
        {
          "name": "38342",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38342"
        },
        {
          "name": "RHSA-2009:1636",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
        },
        {
          "name": "35958",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35958"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "RHSA-2009:1649",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
        },
        {
          "name": "[oss-security] 20091026 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2009/10/26/3"
        },
        {
          "name": "TA09-294A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
        },
        {
          "name": "50549",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50549"
        },
        {
          "name": "oval:org.mitre.oval:def:8520",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "name": "38231",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38231"
        },
        {
          "name": "272209",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1"
        },
        {
          "name": "MDVSA-2011:108",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:108"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "name": "43300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43300"
        },
        {
          "name": "oval:org.mitre.oval:def:9356",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356"
        },
        {
          "name": "TA10-012A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA10-012A.html"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "name": "RHSA-2012:1232",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1232.html"
        },
        {
          "name": "263489",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055\u0026r2=787352\u0026pathrev=787353\u0026diff_format=h"
        },
        {
          "name": "37300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37300"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "SUSE-SA:2009:053",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512921"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "SUSE-SR:2009:017",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
        },
        {
          "name": "[oss-security] 20090906 Re: Re: expat bug 1990430",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2009/09/06/1"
        },
        {
          "name": "[oss-security] 20091023 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2009/10/23/6"
        },
        {
          "name": "ADV-2011-0359",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0359"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        },
        {
          "name": "RHSA-2009:1650",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
        },
        {
          "name": "[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2009-2625",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "SSA:2011-041-02",
              "refsource": "SLACKWARE",
              "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2011\u0026m=slackware-security.486026"
            },
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "RHSA-2009:1199",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
            },
            {
              "name": "http://www.networkworld.com/columnists/2009/080509-xml-flaw.html",
              "refsource": "MISC",
              "url": "http://www.networkworld.com/columnists/2009/080509-xml-flaw.html"
            },
            {
              "name": "USN-890-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-890-1"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "DSA-1984",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2010/dsa-1984"
            },
            {
              "name": "[oss-security] 20091022 Re: Regarding expat bug 1990430",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2009/10/22/9"
            },
            {
              "name": "1021506",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1"
            },
            {
              "name": "37460",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37460"
            },
            {
              "name": "RHSA-2009:1615",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2009-1615.html"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
            },
            {
              "name": "HPSBUX02476",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "37754",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37754"
            },
            {
              "name": "RHSA-2009:1637",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
            },
            {
              "name": "http://www.cert.fi/en/reports/2009/vulnerability2009085.html",
              "refsource": "MISC",
              "url": "http://www.cert.fi/en/reports/2009/vulnerability2009085.html"
            },
            {
              "name": "http://www.codenomicon.com/labs/xml/",
              "refsource": "MISC",
              "url": "http://www.codenomicon.com/labs/xml/"
            },
            {
              "name": "36199",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36199"
            },
            {
              "name": "RHSA-2012:1537",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2012-1537.html"
            },
            {
              "name": "SUSE-SR:2010:013",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "RHSA-2011:0858",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2011-0858.html"
            },
            {
              "name": "SSRT090250",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "1022680",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022680"
            },
            {
              "name": "37671",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37671"
            },
            {
              "name": "38342",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38342"
            },
            {
              "name": "RHSA-2009:1636",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
            },
            {
              "name": "35958",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35958"
            },
            {
              "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
            },
            {
              "name": "RHSA-2009:1649",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
            },
            {
              "name": "[oss-security] 20091026 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2009/10/26/3"
            },
            {
              "name": "TA09-294A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
            },
            {
              "name": "50549",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/50549"
            },
            {
              "name": "oval:org.mitre.oval:def:8520",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "38231",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38231"
            },
            {
              "name": "272209",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1"
            },
            {
              "name": "MDVSA-2011:108",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:108"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "43300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43300"
            },
            {
              "name": "oval:org.mitre.oval:def:9356",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356"
            },
            {
              "name": "TA10-012A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA10-012A.html"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "RHSA-2012:1232",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2012-1232.html"
            },
            {
              "name": "263489",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1"
            },
            {
              "name": "http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055\u0026r2=787352\u0026pathrev=787353\u0026diff_format=h",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055\u0026r2=787352\u0026pathrev=787353\u0026diff_format=h"
            },
            {
              "name": "37300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37300"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "SUSE-SA:2009:053",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=512921",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512921"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "SUSE-SR:2009:017",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
            },
            {
              "name": "[oss-security] 20090906 Re: Re: expat bug 1990430",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2009/09/06/1"
            },
            {
              "name": "[oss-security] 20091023 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2009/10/23/6"
            },
            {
              "name": "ADV-2011-0359",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0359"
            },
            {
              "name": "ADV-2009-3316",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3316"
            },
            {
              "name": "RHSA-2009:1650",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
            },
            {
              "name": "[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2009-2625",
    "datePublished": "2009-08-06T15:00:00",
    "dateReserved": "2009-07-28T00:00:00",
    "dateUpdated": "2024-08-07T05:59:56.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-2689

Vulnerability from cvelistv5

Published

2009-08-10 18:00

Modified

2024-08-07 05:59

Severity ?

Summary

JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.

References

▼	URL	Tags
	https://rhn.redhat.com/errata/RHSA-2009-1199.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9603	vdb-entry, signature, x_refsource_OVAL
	http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisory, x_refsource_GENTOO
	http://secunia.com/advisories/36199	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	http://java.sun.com/javase/6/webnotes/6u15.html	x_refsource_CONFIRM
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1	x_refsource_CONFIRM
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	https://bugzilla.redhat.com/show_bug.cgi?id=513222	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://java.sun.com/j2se/1.5.0/ReleaseNotes.html	x_refsource_CONFIRM
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/37386	third-party-advisory, x_refsource_SECUNIA

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:56.241Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2009:1199",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "oval:org.mitre.oval:def:9603",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9603"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "name": "36199",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36199"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513222"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2009:1199",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "oval:org.mitre.oval:def:9603",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9603"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "name": "36199",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36199"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513222"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2689",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2009:1199",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "oval:org.mitre.oval:def:9603",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9603"
            },
            {
              "name": "GLSA-200911-02",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
            },
            {
              "name": "36199",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36199"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "http://java.sun.com/javase/6/webnotes/6u15.html",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=513222",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513222"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "37386",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37386"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2689",
    "datePublished": "2009-08-10T18:00:00",
    "dateReserved": "2009-08-05T00:00:00",
    "dateUpdated": "2024-08-07T05:59:56.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-2670

Vulnerability from cvelistv5

Published

2009-08-05 19:00

Modified

2024-08-07 05:59

Severity ?

Summary

The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.

References

▼	URL	Tags
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022	vdb-entry, signature, x_refsource_OVAL
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	https://rhn.redhat.com/errata/RHSA-2009-1199.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisory, x_refsource_GENTOO
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1	vendor-advisory, x_refsource_SUNALERT
	http://secunia.com/advisories/36199	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/36248	third-party-advisory, x_refsource_SECUNIA
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	http://osvdb.org/56788	vdb-entry, x_refsource_OSVDB
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://www.securitytracker.com/id?1022658	vdb-entry, x_refsource_SECTRACK
	http://java.sun.com/javase/6/webnotes/6u15.html	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.us-cert.gov/cas/techalerts/TA09-294A.html	third-party-advisory, x_refsource_CERT
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1	x_refsource_CONFIRM
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326	vdb-entry, signature, x_refsource_OVAL
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37300	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37386	third-party-advisory, x_refsource_SECUNIA
	https://exchange.xforce.ibmcloud.com/vulnerabilities/52306	vdb-entry, x_refsource_XF
	http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN
	http://www.securityfocus.com/bid/35939	vdb-entry, x_refsource_BID

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:56.843Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "oval:org.mitre.oval:def:8022",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022"
          },
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "RHSA-2009:1199",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "HPSBUX02476",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "263408",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1"
          },
          {
            "name": "36199",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36199"
          },
          {
            "name": "36248",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36248"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "name": "56788",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/56788"
          },
          {
            "name": "SSRT090250",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "1022658",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022658"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "TA09-294A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "name": "oval:org.mitre.oval:def:11326",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "37300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37300"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "SUSE-SA:2009:053",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "SUSE-SA:2009:043",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          },
          {
            "name": "jre-jdk-audiosystem-priv-escalation(52306)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52306"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          },
          {
            "name": "35939",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35939"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "oval:org.mitre.oval:def:8022",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022"
        },
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "RHSA-2009:1199",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "HPSBUX02476",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "263408",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1"
        },
        {
          "name": "36199",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36199"
        },
        {
          "name": "36248",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36248"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "name": "56788",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/56788"
        },
        {
          "name": "SSRT090250",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "1022658",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022658"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "TA09-294A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "name": "oval:org.mitre.oval:def:11326",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "name": "37300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37300"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "SUSE-SA:2009:053",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "SUSE-SA:2009:043",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        },
        {
          "name": "jre-jdk-audiosystem-priv-escalation(52306)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52306"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        },
        {
          "name": "35939",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35939"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2670",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "oval:org.mitre.oval:def:8022",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022"
            },
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "RHSA-2009:1199",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "37460",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37460"
            },
            {
              "name": "GLSA-200911-02",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
            },
            {
              "name": "HPSBUX02476",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "263408",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1"
            },
            {
              "name": "36199",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36199"
            },
            {
              "name": "36248",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36248"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "56788",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/56788"
            },
            {
              "name": "SSRT090250",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "1022658",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022658"
            },
            {
              "name": "http://java.sun.com/javase/6/webnotes/6u15.html",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
            },
            {
              "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
            },
            {
              "name": "TA09-294A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "oval:org.mitre.oval:def:11326",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "37300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37300"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "SUSE-SA:2009:053",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "SUSE-SA:2009:043",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
            },
            {
              "name": "37386",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37386"
            },
            {
              "name": "jre-jdk-audiosystem-priv-escalation(52306)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52306"
            },
            {
              "name": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
            },
            {
              "name": "ADV-2009-3316",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3316"
            },
            {
              "name": "35939",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35939"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2670",
    "datePublished": "2009-08-05T19:00:00",
    "dateReserved": "2009-08-05T00:00:00",
    "dateUpdated": "2024-08-07T05:59:56.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-2672

Vulnerability from cvelistv5

Published

2009-08-05 19:00

Modified

2024-08-07 05:59

Severity ?

Summary

The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors.

References

▼	URL	Tags
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	https://rhn.redhat.com/errata/RHSA-2009-1199.html	vendor-advisory, x_refsource_REDHAT
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisory, x_refsource_GENTOO
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/36199	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/36248	third-party-advisory, x_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7723	vdb-entry, signature, x_refsource_OVAL
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://java.sun.com/javase/6/webnotes/6u15.html	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.us-cert.gov/cas/techalerts/TA09-294A.html	third-party-advisory, x_refsource_CERT
	http://www.securityfocus.com/bid/35943	vdb-entry, x_refsource_BID
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9359	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	https://exchange.xforce.ibmcloud.com/vulnerabilities/52337	vdb-entry, x_refsource_XF
	http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1	vendor-advisory, x_refsource_SUNALERT
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	http://www.securitytracker.com/id?1022659	vdb-entry, x_refsource_SECTRACK
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37300	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37386	third-party-advisory, x_refsource_SECUNIA
	http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:56.979Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "RHSA-2009:1199",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "HPSBUX02476",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "36199",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36199"
          },
          {
            "name": "36248",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36248"
          },
          {
            "name": "oval:org.mitre.oval:def:7723",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7723"
          },
          {
            "name": "SSRT090250",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "TA09-294A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
          },
          {
            "name": "35943",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35943"
          },
          {
            "name": "oval:org.mitre.oval:def:9359",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9359"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "name": "sun-jre-proxy-session-hijacking(52337)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52337"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
          },
          {
            "name": "263409",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "1022659",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022659"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "37300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37300"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "SUSE-SA:2009:053",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "SUSE-SA:2009:043",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "RHSA-2009:1199",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "HPSBUX02476",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "36199",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36199"
        },
        {
          "name": "36248",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36248"
        },
        {
          "name": "oval:org.mitre.oval:def:7723",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7723"
        },
        {
          "name": "SSRT090250",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "TA09-294A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
        },
        {
          "name": "35943",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35943"
        },
        {
          "name": "oval:org.mitre.oval:def:9359",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9359"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "name": "sun-jre-proxy-session-hijacking(52337)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52337"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
        },
        {
          "name": "263409",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "1022659",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022659"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "name": "37300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37300"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "SUSE-SA:2009:053",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "SUSE-SA:2009:043",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2672",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "RHSA-2009:1199",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "37460",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37460"
            },
            {
              "name": "GLSA-200911-02",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
            },
            {
              "name": "HPSBUX02476",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "36199",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36199"
            },
            {
              "name": "36248",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36248"
            },
            {
              "name": "oval:org.mitre.oval:def:7723",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7723"
            },
            {
              "name": "SSRT090250",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "http://java.sun.com/javase/6/webnotes/6u15.html",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
            },
            {
              "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
            },
            {
              "name": "TA09-294A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
            },
            {
              "name": "35943",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35943"
            },
            {
              "name": "oval:org.mitre.oval:def:9359",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9359"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "sun-jre-proxy-session-hijacking(52337)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52337"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
            },
            {
              "name": "263409",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "1022659",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022659"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "37300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37300"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "SUSE-SA:2009:053",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "SUSE-SA:2009:043",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
            },
            {
              "name": "37386",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37386"
            },
            {
              "name": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
            },
            {
              "name": "ADV-2009-3316",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3316"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2672",
    "datePublished": "2009-08-05T19:00:00",
    "dateReserved": "2009-08-05T00:00:00",
    "dateUpdated": "2024-08-07T05:59:56.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-2671

Vulnerability from cvelistv5

Published

2009-08-05 19:00

Modified

2024-08-07 05:59

Severity ?

Summary

The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors.

References

▼	URL	Tags
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11115	vdb-entry, signature, x_refsource_OVAL
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	https://rhn.redhat.com/errata/RHSA-2009-1199.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	https://exchange.xforce.ibmcloud.com/vulnerabilities/52336	vdb-entry, x_refsource_XF
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisory, x_refsource_GENTOO
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/36199	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/36248	third-party-advisory, x_refsource_SECUNIA
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://java.sun.com/javase/6/webnotes/6u15.html	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.us-cert.gov/cas/techalerts/TA09-294A.html	third-party-advisory, x_refsource_CERT
	http://www.securityfocus.com/bid/35943	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1	vendor-advisory, x_refsource_SUNALERT
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	http://www.securitytracker.com/id?1022659	vdb-entry, x_refsource_SECTRACK
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37300	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37386	third-party-advisory, x_refsource_SECUNIA
	http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8259	vdb-entry, signature, x_refsource_OVAL

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:56.765Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "oval:org.mitre.oval:def:11115",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11115"
          },
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "RHSA-2009:1199",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "sun-jre-socks-info-disclosure(52336)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52336"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "HPSBUX02476",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "36199",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36199"
          },
          {
            "name": "36248",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36248"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "name": "SSRT090250",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "TA09-294A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
          },
          {
            "name": "35943",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35943"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
          },
          {
            "name": "263409",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "name": "1022659",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022659"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "37300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37300"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "SUSE-SA:2009:053",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "SUSE-SA:2009:043",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          },
          {
            "name": "oval:org.mitre.oval:def:8259",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8259"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "oval:org.mitre.oval:def:11115",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11115"
        },
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "RHSA-2009:1199",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "sun-jre-socks-info-disclosure(52336)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52336"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "HPSBUX02476",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "36199",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36199"
        },
        {
          "name": "36248",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36248"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "name": "SSRT090250",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "TA09-294A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
        },
        {
          "name": "35943",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35943"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
        },
        {
          "name": "263409",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "name": "1022659",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022659"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "name": "37300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37300"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "SUSE-SA:2009:053",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "SUSE-SA:2009:043",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        },
        {
          "name": "oval:org.mitre.oval:def:8259",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8259"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2671",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "oval:org.mitre.oval:def:11115",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11115"
            },
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "RHSA-2009:1199",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "sun-jre-socks-info-disclosure(52336)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52336"
            },
            {
              "name": "37460",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37460"
            },
            {
              "name": "GLSA-200911-02",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
            },
            {
              "name": "HPSBUX02476",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "36199",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36199"
            },
            {
              "name": "36248",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36248"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "SSRT090250",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "http://java.sun.com/javase/6/webnotes/6u15.html",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
            },
            {
              "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
            },
            {
              "name": "TA09-294A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
            },
            {
              "name": "35943",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35943"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
            },
            {
              "name": "263409",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "1022659",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022659"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "37300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37300"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "SUSE-SA:2009:053",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "SUSE-SA:2009:043",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
            },
            {
              "name": "37386",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37386"
            },
            {
              "name": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
            },
            {
              "name": "ADV-2009-3316",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3316"
            },
            {
              "name": "oval:org.mitre.oval:def:8259",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8259"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2671",
    "datePublished": "2009-08-05T19:00:00",
    "dateReserved": "2009-08-05T00:00:00",
    "dateUpdated": "2024-08-07T05:59:56.765Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-2475

Vulnerability from cvelistv5

Published

2009-08-10 18:00

Modified

2024-08-07 05:52

Severity ?

Summary

Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.

References

▼	URL	Tags
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=513215	x_refsource_CONFIRM
	https://rhn.redhat.com/errata/RHSA-2009-1199.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisory, x_refsource_GENTOO
	http://secunia.com/advisories/36199	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	http://java.sun.com/javase/6/webnotes/6u15.html	x_refsource_CONFIRM
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1	x_refsource_CONFIRM
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://java.sun.com/j2se/1.5.0/ReleaseNotes.html	x_refsource_CONFIRM
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10221	vdb-entry, signature, x_refsource_OVAL
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/37386	third-party-advisory, x_refsource_SECUNIA

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:52:14.899Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513215"
          },
          {
            "name": "RHSA-2009:1199",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "name": "36199",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36199"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html"
          },
          {
            "name": "oval:org.mitre.oval:def:10221",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10221"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513215"
        },
        {
          "name": "RHSA-2009:1199",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "name": "36199",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36199"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html"
        },
        {
          "name": "oval:org.mitre.oval:def:10221",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10221"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-2475",
    "datePublished": "2009-08-10T18:00:00",
    "dateReserved": "2009-07-15T00:00:00",
    "dateUpdated": "2024-08-07T05:52:14.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-2476

Vulnerability from cvelistv5

Published

2009-08-10 18:00

Modified

2024-08-07 05:52

Severity ?

Summary

The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=513220	x_refsource_CONFIRM
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisory, x_refsource_GENTOO
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10381	vdb-entry, signature, x_refsource_OVAL
	http://java.sun.com/javase/6/webnotes/6u15.html	x_refsource_CONFIRM
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/37386	third-party-advisory, x_refsource_SECUNIA

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:52:15.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513220"
          },
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "name": "oval:org.mitre.oval:def:10381",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10381"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513220"
        },
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "name": "oval:org.mitre.oval:def:10381",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10381"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-2476",
    "datePublished": "2009-08-10T18:00:00",
    "dateReserved": "2009-07-15T00:00:00",
    "dateUpdated": "2024-08-07T05:52:15.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-2690

Vulnerability from cvelistv5

Published

2009-08-10 18:00

Modified

2024-08-07 05:59

Severity ?

Summary

The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.

References

▼	URL	Tags
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisory, x_refsource_GENTOO
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1	x_refsource_CONFIRM
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9443	vdb-entry, signature, x_refsource_OVAL
	https://bugzilla.redhat.com/show_bug.cgi?id=513223	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	http://java.sun.com/javase/6/webnotes/6u15.html	x_refsource_CONFIRM
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/37386	third-party-advisory, x_refsource_SECUNIA

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:56.702Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1"
          },
          {
            "name": "oval:org.mitre.oval:def:9443",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9443"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513223"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1"
        },
        {
          "name": "oval:org.mitre.oval:def:9443",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9443"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513223"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2690",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "GLSA-200911-02",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1"
            },
            {
              "name": "oval:org.mitre.oval:def:9443",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9443"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=513223",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513223"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "http://java.sun.com/javase/6/webnotes/6u15.html",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "37386",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37386"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2690",
    "datePublished": "2009-08-10T18:00:00",
    "dateReserved": "2009-08-05T00:00:00",
    "dateUpdated": "2024-08-07T05:59:56.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-0217

Vulnerability from cvelistv5

Published

2009-07-14 23:00

Modified

2024-08-07 04:24

Severity ?

Summary

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

References

▼	URL	Tags
	https://rhn.redhat.com/errata/RHSA-2009-1428.html	vendor-advisory, x_refsource_REDHAT
	http://www.vupen.com/english/advisories/2009/3122	vdb-entry, x_refsource_VUPEN
	http://www.openoffice.org/security/cves/CVE-2009-0217.html	x_refsource_CONFIRM
	https://issues.apache.org/bugzilla/show_bug.cgi?id=47526	x_refsource_CONFIRM
	http://secunia.com/advisories/60799	third-party-advisory, x_refsource_SECUNIA
	http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml	vendor-advisory, x_refsource_GENTOO
	http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere	vendor-advisory, x_refsource_AIXAPAR
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/35776	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/36494	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/35858	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/38695	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1	vendor-advisory, x_refsource_SUNALERT
	http://www.debian.org/security/2010/dsa-1995	vendor-advisory, x_refsource_DEBIAN
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/35853	third-party-advisory, x_refsource_SECUNIA
	https://rhn.redhat.com/errata/RHSA-2009-1637.html	vendor-advisory, x_refsource_REDHAT
	http://www.redhat.com/support/errata/RHSA-2009-1694.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/35852	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/35854	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/34461	third-party-advisory, x_refsource_SECUNIA
	http://www.kb.cert.org/vuls/id/WDON-7TY529	x_refsource_CONFIRM
	http://www.mono-project.com/Vulnerabilities	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1	vendor-advisory, x_refsource_SUNALERT
	http://www.ubuntu.com/usn/USN-903-1	vendor-advisory, x_refsource_UBUNTU
	http://www.securityfocus.com/bid/35671	vdb-entry, x_refsource_BID
	https://issues.apache.org/bugzilla/show_bug.cgi?id=47527	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2010/0366	vdb-entry, x_refsource_VUPEN
	http://osvdb.org/55907	vdb-entry, x_refsource_OSVDB
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/38567	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1	vendor-advisory, x_refsource_SUNALERT
	http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://www.vupen.com/english/advisories/2009/1900	vdb-entry, x_refsource_VUPEN
	http://www.securitytracker.com/id?1022561	vdb-entry, x_refsource_SECTRACK
	http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html	x_refsource_CONFIRM
	http://secunia.com/advisories/37671	third-party-advisory, x_refsource_SECUNIA
	http://www.kb.cert.org/vuls/id/466161	third-party-advisory, x_refsource_CERT-VN
	http://www.securitytracker.com/id?1022567	vdb-entry, x_refsource_SECTRACK
	https://rhn.redhat.com/errata/RHSA-2009-1636.html	vendor-advisory, x_refsource_REDHAT
	http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere	vendor-advisory, x_refsource_AIXAPAR
	https://rhn.redhat.com/errata/RHSA-2009-1649.html	vendor-advisory, x_refsource_REDHAT
	http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html	x_refsource_CONFIRM
	http://www.us-cert.gov/cas/techalerts/TA09-294A.html	third-party-advisory, x_refsource_CERT
	http://www.vupen.com/english/advisories/2009/1909	vdb-entry, x_refsource_VUPEN
	http://www.vupen.com/english/advisories/2010/0635	vdb-entry, x_refsource_VUPEN
	http://svn.apache.org/viewvc?revision=794013&view=revision	x_refsource_CONFIRM
	http://secunia.com/advisories/38568	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html	vendor-advisory, x_refsource_FEDORA
	http://www.w3.org/2008/06/xmldsigcore-errata.html#e03	x_refsource_CONFIRM
	https://usn.ubuntu.com/826-1/	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/37841	third-party-advisory, x_refsource_SECUNIA
	http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1	x_refsource_CONFIRM
	http://secunia.com/advisories/35855	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158	vdb-entry, signature, x_refsource_OVAL
	http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html	x_refsource_MISC
	http://www.vupen.com/english/advisories/2009/1908	vdb-entry, x_refsource_VUPEN
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7	x_refsource_CONFIRM
	http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925	x_refsource_CONFIRM
	http://secunia.com/advisories/41818	third-party-advisory, x_refsource_SECUNIA
	http://www.securitytracker.com/id?1022661	vdb-entry, x_refsource_SECTRACK
	http://secunia.com/advisories/37300	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/1911	vdb-entry, x_refsource_VUPEN
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717	vdb-entry, signature, x_refsource_OVAL
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7	x_refsource_CONFIRM
	http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ	x_refsource_CONFIRM
	http://www.us-cert.gov/cas/techalerts/TA10-159B.html	third-party-advisory, x_refsource_CERT
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186	vdb-entry, signature, x_refsource_OVAL
	http://osvdb.org/55895	vdb-entry, x_refsource_OSVDB
	http://www.aleksey.com/xmlsec/	x_refsource_CONFIRM
	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041	vendor-advisory, x_refsource_MS
	http://secunia.com/advisories/38921	third-party-advisory, x_refsource_SECUNIA
	https://rhn.redhat.com/errata/RHSA-2009-1650.html	vendor-advisory, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=511915	x_refsource_CONFIRM

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:24:18.400Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2009:1428",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
          },
          {
            "name": "ADV-2009-3122",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3122"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
          },
          {
            "name": "60799",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60799"
          },
          {
            "name": "GLSA-201408-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
          },
          {
            "name": "PK80596",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
          },
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "35776",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35776"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "36494",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36494"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "35858",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35858"
          },
          {
            "name": "38695",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38695"
          },
          {
            "name": "269208",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"
          },
          {
            "name": "DSA-1995",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2010/dsa-1995"
          },
          {
            "name": "HPSBUX02476",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "35853",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35853"
          },
          {
            "name": "RHSA-2009:1637",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
          },
          {
            "name": "RHSA-2009:1694",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html"
          },
          {
            "name": "35852",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35852"
          },
          {
            "name": "35854",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35854"
          },
          {
            "name": "34461",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34461"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/WDON-7TY529"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mono-project.com/Vulnerabilities"
          },
          {
            "name": "1020710",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"
          },
          {
            "name": "USN-903-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-903-1"
          },
          {
            "name": "35671",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35671"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
          },
          {
            "name": "ADV-2010-0366",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0366"
          },
          {
            "name": "55907",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/55907"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "SUSE-SA:2010:017",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
          },
          {
            "name": "38567",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38567"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "name": "263429",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"
          },
          {
            "name": "SSRT090250",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "ADV-2009-1900",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1900"
          },
          {
            "name": "1022561",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022561"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
          },
          {
            "name": "37671",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37671"
          },
          {
            "name": "VU#466161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/466161"
          },
          {
            "name": "1022567",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022567"
          },
          {
            "name": "RHSA-2009:1636",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
          },
          {
            "name": "PK80627",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
          },
          {
            "name": "RHSA-2009:1649",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"
          },
          {
            "name": "TA09-294A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
          },
          {
            "name": "ADV-2009-1909",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1909"
          },
          {
            "name": "ADV-2010-0635",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0635"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision"
          },
          {
            "name": "38568",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38568"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "name": "FEDORA-2009-8456",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
          },
          {
            "name": "USN-826-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/826-1/"
          },
          {
            "name": "37841",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37841"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
          },
          {
            "name": "35855",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35855"
          },
          {
            "name": "FEDORA-2009-8473",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "oval:org.mitre.oval:def:7158",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
          },
          {
            "name": "ADV-2009-1908",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1908"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925"
          },
          {
            "name": "41818",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/41818"
          },
          {
            "name": "1022661",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022661"
          },
          {
            "name": "37300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37300"
          },
          {
            "name": "ADV-2009-1911",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1911"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "SUSE-SA:2009:053",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
          },
          {
            "name": "oval:org.mitre.oval:def:8717",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
          },
          {
            "name": "TA10-159B",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
          },
          {
            "name": "oval:org.mitre.oval:def:10186",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"
          },
          {
            "name": "55895",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/55895"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.aleksey.com/xmlsec/"
          },
          {
            "name": "MS10-041",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
          },
          {
            "name": "38921",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38921"
          },
          {
            "name": "RHSA-2009:1650",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-07-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "name": "RHSA-2009:1428",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
        },
        {
          "name": "ADV-2009-3122",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3122"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
        },
        {
          "name": "60799",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60799"
        },
        {
          "name": "GLSA-201408-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
        },
        {
          "name": "PK80596",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
        },
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "35776",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35776"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "36494",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36494"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "35858",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35858"
        },
        {
          "name": "38695",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38695"
        },
        {
          "name": "269208",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"
        },
        {
          "name": "DSA-1995",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2010/dsa-1995"
        },
        {
          "name": "HPSBUX02476",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "35853",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35853"
        },
        {
          "name": "RHSA-2009:1637",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
        },
        {
          "name": "RHSA-2009:1694",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html"
        },
        {
          "name": "35852",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35852"
        },
        {
          "name": "35854",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35854"
        },
        {
          "name": "34461",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34461"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kb.cert.org/vuls/id/WDON-7TY529"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mono-project.com/Vulnerabilities"
        },
        {
          "name": "1020710",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"
        },
        {
          "name": "USN-903-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-903-1"
        },
        {
          "name": "35671",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35671"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
        },
        {
          "name": "ADV-2010-0366",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0366"
        },
        {
          "name": "55907",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/55907"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "SUSE-SA:2010:017",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
        },
        {
          "name": "38567",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38567"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "name": "263429",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"
        },
        {
          "name": "SSRT090250",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "ADV-2009-1900",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1900"
        },
        {
          "name": "1022561",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022561"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
        },
        {
          "name": "37671",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37671"
        },
        {
          "name": "VU#466161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/466161"
        },
        {
          "name": "1022567",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022567"
        },
        {
          "name": "RHSA-2009:1636",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
        },
        {
          "name": "PK80627",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
        },
        {
          "name": "RHSA-2009:1649",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"
        },
        {
          "name": "TA09-294A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
        },
        {
          "name": "ADV-2009-1909",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1909"
        },
        {
          "name": "ADV-2010-0635",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0635"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision"
        },
        {
          "name": "38568",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38568"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "name": "FEDORA-2009-8456",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
        },
        {
          "name": "USN-826-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/826-1/"
        },
        {
          "name": "37841",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37841"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
        },
        {
          "name": "35855",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35855"
        },
        {
          "name": "FEDORA-2009-8473",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "oval:org.mitre.oval:def:7158",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
        },
        {
          "name": "ADV-2009-1908",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1908"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925"
        },
        {
          "name": "41818",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/41818"
        },
        {
          "name": "1022661",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022661"
        },
        {
          "name": "37300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37300"
        },
        {
          "name": "ADV-2009-1911",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1911"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "SUSE-SA:2009:053",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
        },
        {
          "name": "oval:org.mitre.oval:def:8717",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
        },
        {
          "name": "TA10-159B",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
        },
        {
          "name": "oval:org.mitre.oval:def:10186",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"
        },
        {
          "name": "55895",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/55895"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.aleksey.com/xmlsec/"
        },
        {
          "name": "MS10-041",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
        },
        {
          "name": "38921",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38921"
        },
        {
          "name": "RHSA-2009:1650",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2009-0217",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2009:1428",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
            },
            {
              "name": "ADV-2009-3122",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3122"
            },
            {
              "name": "http://www.openoffice.org/security/cves/CVE-2009-0217.html",
              "refsource": "CONFIRM",
              "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
            },
            {
              "name": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526",
              "refsource": "CONFIRM",
              "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
            },
            {
              "name": "60799",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60799"
            },
            {
              "name": "GLSA-201408-19",
              "refsource": "GENTOO",
              "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
            },
            {
              "name": "PK80596",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
            },
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "35776",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35776"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "36494",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36494"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "35858",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35858"
            },
            {
              "name": "38695",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38695"
            },
            {
              "name": "269208",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"
            },
            {
              "name": "DSA-1995",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2010/dsa-1995"
            },
            {
              "name": "HPSBUX02476",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "35853",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35853"
            },
            {
              "name": "RHSA-2009:1637",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
            },
            {
              "name": "RHSA-2009:1694",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html"
            },
            {
              "name": "35852",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35852"
            },
            {
              "name": "35854",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35854"
            },
            {
              "name": "34461",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34461"
            },
            {
              "name": "http://www.kb.cert.org/vuls/id/WDON-7TY529",
              "refsource": "CONFIRM",
              "url": "http://www.kb.cert.org/vuls/id/WDON-7TY529"
            },
            {
              "name": "http://www.mono-project.com/Vulnerabilities",
              "refsource": "CONFIRM",
              "url": "http://www.mono-project.com/Vulnerabilities"
            },
            {
              "name": "1020710",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"
            },
            {
              "name": "USN-903-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-903-1"
            },
            {
              "name": "35671",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35671"
            },
            {
              "name": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527",
              "refsource": "CONFIRM",
              "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
            },
            {
              "name": "ADV-2010-0366",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/0366"
            },
            {
              "name": "55907",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/55907"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "SUSE-SA:2010:017",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
            },
            {
              "name": "38567",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38567"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "263429",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"
            },
            {
              "name": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161",
              "refsource": "CONFIRM",
              "url": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"
            },
            {
              "name": "SSRT090250",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "ADV-2009-1900",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1900"
            },
            {
              "name": "1022561",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022561"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
            },
            {
              "name": "37671",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37671"
            },
            {
              "name": "VU#466161",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/466161"
            },
            {
              "name": "1022567",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022567"
            },
            {
              "name": "RHSA-2009:1636",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
            },
            {
              "name": "PK80627",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
            },
            {
              "name": "RHSA-2009:1649",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"
            },
            {
              "name": "TA09-294A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
            },
            {
              "name": "ADV-2009-1909",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1909"
            },
            {
              "name": "ADV-2010-0635",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/0635"
            },
            {
              "name": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision"
            },
            {
              "name": "38568",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38568"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "FEDORA-2009-8456",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
            },
            {
              "name": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03",
              "refsource": "CONFIRM",
              "url": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
            },
            {
              "name": "USN-826-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/826-1/"
            },
            {
              "name": "37841",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37841"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
            },
            {
              "name": "35855",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35855"
            },
            {
              "name": "FEDORA-2009-8473",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "oval:org.mitre.oval:def:7158",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"
            },
            {
              "name": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html",
              "refsource": "MISC",
              "url": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
            },
            {
              "name": "ADV-2009-1908",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1908"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
              "refsource": "CONFIRM",
              "url": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925"
            },
            {
              "name": "41818",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/41818"
            },
            {
              "name": "1022661",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022661"
            },
            {
              "name": "37300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37300"
            },
            {
              "name": "ADV-2009-1911",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1911"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "SUSE-SA:2009:053",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
            },
            {
              "name": "oval:org.mitre.oval:def:8717",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
              "refsource": "CONFIRM",
              "url": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
            },
            {
              "name": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ",
              "refsource": "CONFIRM",
              "url": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
            },
            {
              "name": "TA10-159B",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
            },
            {
              "name": "oval:org.mitre.oval:def:10186",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"
            },
            {
              "name": "55895",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/55895"
            },
            {
              "name": "http://www.aleksey.com/xmlsec/",
              "refsource": "CONFIRM",
              "url": "http://www.aleksey.com/xmlsec/"
            },
            {
              "name": "MS10-041",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
            },
            {
              "name": "38921",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38921"
            },
            {
              "name": "RHSA-2009:1650",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=511915",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2009-0217",
    "datePublished": "2009-07-14T23:00:00",
    "dateReserved": "2009-01-20T00:00:00",
    "dateUpdated": "2024-08-07T04:24:18.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-2674

Vulnerability from cvelistv5

Published

2009-08-05 19:00

Modified

2024-08-07 05:59

Severity ?

Summary

Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow.

References

▼	URL	Tags
	http://www.zerodayinitiative.com/advisories/ZDI-09-050/	x_refsource_MISC
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisory, x_refsource_GENTOO
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10073	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/36248	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-263428-1	vendor-advisory, x_refsource_SUNALERT
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://www.us-cert.gov/cas/techalerts/TA09-294A.html	third-party-advisory, x_refsource_CERT
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8073	vdb-entry, signature, x_refsource_OVAL
	http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1	x_refsource_CONFIRM
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37300	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37386	third-party-advisory, x_refsource_SECUNIA
	https://exchange.xforce.ibmcloud.com/vulnerabilities/52339	vdb-entry, x_refsource_XF

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:56.647Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-050/"
          },
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "name": "HPSBUX02476",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "oval:org.mitre.oval:def:10073",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10073"
          },
          {
            "name": "36248",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36248"
          },
          {
            "name": "263428",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263428-1"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "name": "SSRT090250",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "TA09-294A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "name": "oval:org.mitre.oval:def:8073",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8073"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "37300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37300"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "SUSE-SA:2009:053",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "SUSE-SA:2009:043",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          },
          {
            "name": "sun-jre-jpeg-bo(52339)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52339"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-050/"
        },
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "name": "HPSBUX02476",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "oval:org.mitre.oval:def:10073",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10073"
        },
        {
          "name": "36248",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36248"
        },
        {
          "name": "263428",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263428-1"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "name": "SSRT090250",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "TA09-294A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "name": "oval:org.mitre.oval:def:8073",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8073"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "name": "37300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37300"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "SUSE-SA:2009:053",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "SUSE-SA:2009:043",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        },
        {
          "name": "sun-jre-jpeg-bo(52339)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52339"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2674",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.zerodayinitiative.com/advisories/ZDI-09-050/",
              "refsource": "MISC",
              "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-050/"
            },
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "GLSA-200911-02",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
            },
            {
              "name": "HPSBUX02476",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "oval:org.mitre.oval:def:10073",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10073"
            },
            {
              "name": "36248",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36248"
            },
            {
              "name": "263428",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263428-1"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "SSRT090250",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "TA09-294A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "oval:org.mitre.oval:def:8073",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8073"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "37300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37300"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "SUSE-SA:2009:053",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "SUSE-SA:2009:043",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
            },
            {
              "name": "37386",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37386"
            },
            {
              "name": "sun-jre-jpeg-bo(52339)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52339"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2674",
    "datePublished": "2009-08-05T19:00:00",
    "dateReserved": "2009-08-05T00:00:00",
    "dateUpdated": "2024-08-07T05:59:56.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-2675

Vulnerability from cvelistv5

Published

2009-08-05 19:00

Modified

2024-08-07 05:59

Severity ?

Summary

Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression.

References

▼	URL	Tags
	http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=814	third-party-advisory, x_refsource_IDEFENSE
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-263488-1	vendor-advisory, x_refsource_SUNALERT
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10840	vdb-entry, signature, x_refsource_OVAL
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	https://rhn.redhat.com/errata/RHSA-2009-1199.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisory, x_refsource_GENTOO
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	https://exchange.xforce.ibmcloud.com/vulnerabilities/52307	vdb-entry, x_refsource_XF
	http://secunia.com/advisories/36199	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/36248	third-party-advisory, x_refsource_SECUNIA
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.us-cert.gov/cas/techalerts/TA09-294A.html	third-party-advisory, x_refsource_CERT
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1	x_refsource_CONFIRM
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8415	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37300	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37386	third-party-advisory, x_refsource_SECUNIA
	http://www.zerodayinitiative.com/advisories/ZDI-09-049/	x_refsource_MISC
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:57.038Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20090804 Sun Java Runtime Environment (JRE) Pack200 Decompression Integer Overflow Vulnerability",
            "tags": [
              "third-party-advisory",
              "x_refsource_IDEFENSE",
              "x_transferred"
            ],
            "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=814"
          },
          {
            "name": "263488",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263488-1"
          },
          {
            "name": "oval:org.mitre.oval:def:10840",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10840"
          },
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "RHSA-2009:1199",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "HPSBUX02476",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "jre-pak200-bo(52307)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52307"
          },
          {
            "name": "36199",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36199"
          },
          {
            "name": "36248",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36248"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "name": "SSRT090250",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "TA09-294A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
          },
          {
            "name": "oval:org.mitre.oval:def:8415",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8415"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "37300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37300"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "SUSE-SA:2009:053",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "SUSE-SA:2009:043",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-049/"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20090804 Sun Java Runtime Environment (JRE) Pack200 Decompression Integer Overflow Vulnerability",
          "tags": [
            "third-party-advisory",
            "x_refsource_IDEFENSE"
          ],
          "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=814"
        },
        {
          "name": "263488",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263488-1"
        },
        {
          "name": "oval:org.mitre.oval:def:10840",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10840"
        },
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "RHSA-2009:1199",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "HPSBUX02476",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "jre-pak200-bo(52307)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52307"
        },
        {
          "name": "36199",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36199"
        },
        {
          "name": "36248",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36248"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "name": "SSRT090250",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "TA09-294A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
        },
        {
          "name": "oval:org.mitre.oval:def:8415",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8415"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "name": "37300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37300"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "SUSE-SA:2009:053",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "SUSE-SA:2009:043",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-049/"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2675",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20090804 Sun Java Runtime Environment (JRE) Pack200 Decompression Integer Overflow Vulnerability",
              "refsource": "IDEFENSE",
              "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=814"
            },
            {
              "name": "263488",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263488-1"
            },
            {
              "name": "oval:org.mitre.oval:def:10840",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10840"
            },
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "RHSA-2009:1199",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "37460",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37460"
            },
            {
              "name": "GLSA-200911-02",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
            },
            {
              "name": "HPSBUX02476",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "jre-pak200-bo(52307)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52307"
            },
            {
              "name": "36199",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36199"
            },
            {
              "name": "36248",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36248"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "SSRT090250",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
            },
            {
              "name": "TA09-294A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
            },
            {
              "name": "oval:org.mitre.oval:def:8415",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8415"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "37300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37300"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "SUSE-SA:2009:053",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "SUSE-SA:2009:043",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
            },
            {
              "name": "37386",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37386"
            },
            {
              "name": "http://www.zerodayinitiative.com/advisories/ZDI-09-049/",
              "refsource": "MISC",
              "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-049/"
            },
            {
              "name": "ADV-2009-3316",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3316"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2675",
    "datePublished": "2009-08-05T19:00:00",
    "dateReserved": "2009-08-05T00:00:00",
    "dateUpdated": "2024-08-07T05:59:57.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-2673

Vulnerability from cvelistv5

Published

2009-08-05 19:00

Modified

2024-08-07 05:59

Severity ?

Summary

The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword.

References

▼	URL	Tags
	https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor-advisory, x_refsource_REDHAT
	https://rhn.redhat.com/errata/RHSA-2009-1199.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/36162	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/2543	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8558	vdb-entry, signature, x_refsource_OVAL
	http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisory, x_refsource_GENTOO
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/36199	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/36248	third-party-advisory, x_refsource_SECUNIA
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor-advisory, x_refsource_FEDORA
	http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor-advisory, x_refsource_HP
	http://java.sun.com/javase/6/webnotes/6u15.html	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.us-cert.gov/cas/techalerts/TA09-294A.html	third-party-advisory, x_refsource_CERT
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10263	vdb-entry, signature, x_refsource_OVAL
	http://www.securityfocus.com/bid/35943	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/36180	third-party-advisory, x_refsource_SECUNIA
	http://osvdb.org/56785	vdb-entry, x_refsource_OSVDB
	http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1	x_refsource_CONFIRM
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1	vendor-advisory, x_refsource_SUNALERT
	http://secunia.com/advisories/36176	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor-advisory, x_refsource_FEDORA
	http://www.securitytracker.com/id?1022659	vdb-entry, x_refsource_SECTRACK
	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37300	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor-advisory, x_refsource_APPLE
	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor-advisory, x_refsource_REDHAT
	https://exchange.xforce.ibmcloud.com/vulnerabilities/52338	vdb-entry, x_refsource_XF
	http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/37386	third-party-advisory, x_refsource_SECUNIA
	http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:56.917Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "RHSA-2009:1199",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "oval:org.mitre.oval:def:8558",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8558"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "HPSBUX02476",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "36199",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36199"
          },
          {
            "name": "36248",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36248"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "name": "SSRT090250",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "TA09-294A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
          },
          {
            "name": "oval:org.mitre.oval:def:10263",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10263"
          },
          {
            "name": "35943",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35943"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "name": "56785",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/56785"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
          },
          {
            "name": "263409",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "name": "1022659",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022659"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "37300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37300"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "SUSE-SA:2009:053",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "sun-jre-proxy-security-bypass(52338)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52338"
          },
          {
            "name": "SUSE-SA:2009:043",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "RHSA-2009:1199",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "oval:org.mitre.oval:def:8558",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8558"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "HPSBUX02476",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "36199",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36199"
        },
        {
          "name": "36248",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36248"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "name": "SSRT090250",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "TA09-294A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
        },
        {
          "name": "oval:org.mitre.oval:def:10263",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10263"
        },
        {
          "name": "35943",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35943"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "name": "56785",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/56785"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
        },
        {
          "name": "263409",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "name": "1022659",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022659"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "name": "37300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37300"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "SUSE-SA:2009:053",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "name": "sun-jre-proxy-security-bypass(52338)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52338"
        },
        {
          "name": "SUSE-SA:2009:043",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2673",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "RHSA-2009:1199",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "37460",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37460"
            },
            {
              "name": "oval:org.mitre.oval:def:8558",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8558"
            },
            {
              "name": "GLSA-200911-02",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
            },
            {
              "name": "HPSBUX02476",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "36199",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36199"
            },
            {
              "name": "36248",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36248"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "SSRT090250",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "http://java.sun.com/javase/6/webnotes/6u15.html",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/javase/6/webnotes/6u15.html"
            },
            {
              "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
            },
            {
              "name": "TA09-294A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
            },
            {
              "name": "oval:org.mitre.oval:def:10263",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10263"
            },
            {
              "name": "35943",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35943"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "56785",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/56785"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
            },
            {
              "name": "263409",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "1022659",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022659"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "37300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37300"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "SUSE-SA:2009:053",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "sun-jre-proxy-security-bypass(52338)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52338"
            },
            {
              "name": "SUSE-SA:2009:043",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html"
            },
            {
              "name": "37386",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37386"
            },
            {
              "name": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20",
              "refsource": "CONFIRM",
              "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20"
            },
            {
              "name": "ADV-2009-3316",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3316"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2673",
    "datePublished": "2009-08-05T19:00:00",
    "dateReserved": "2009-08-05T00:00:00",
    "dateUpdated": "2024-08-07T05:59:56.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Action not permitted

Vulnerability from csaf_redhat

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags