CVSS: 6.8EPSS: 2%CPEs: 138EXPL: 0CVE-2009-2676 – JRE applet launcher vulnerability
https://notcve.org/view.php?id=CVE-2009-2676
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher. Vulnerabilidad no especificada en JNLPAppletlauncher en Sun Java SE, y SE Business, en JDK y JRE 6v Update v14 y anteriores y JDK y JRE v5.0 Update v19 y anteriores; y Java SE para Business de SDK y JRE v1.4.2_21 y anteriores, permiten a atacantes remotos crear o modificar un fichero a su elección a través de un vector relacionado con un applet Java no confiable. • http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html http://marc.info/?l=bugtraq&m=125787273209737&w=2 http://osvdb.org/56789 http://secunia.com/advisories/36176 http://secunia.com/advisories/36199 http://secunia.com/advisories/36248 http://secunia.com/advisories/37300 http://secunia.com/advisories/37386 http://secunia.com/advisories/37460 http://security.gentoo.org/glsa/glsa-2009 •
CVSS: 7.5EPSS: 70%CPEs: 3EXPL: 0CVE-2009-1099 – OpenJDK: Type1 font processing buffer overflow vulnerability
https://notcve.org/view.php?id=CVE-2009-1099
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow. Un error de firma de enteros en Java SE Development Kit (JDK) y Java Runtime Environment (JRE) versiones 5.0 Update 17 y anteriores, y versiones 6 Update 12 y anteriores, permite a los atacantes remotos acceder a archivos o ejecutar código arbitrario por medio de descripciones de glifos diseñados en una fuente Type1, lo que omite una comparación firmada y desencadena un desbordamiento de búfer. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=777 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html http://marc.info/?l=bugtraq&m=124344236 • CWE-189: Numeric Errors •