CVSS: 10.0EPSS: 84%CPEs: 61EXPL: 0CVE-2009-1095 – OpenJDK Pack200 Buffer overflow vulnerability (6792554)
https://notcve.org/view.php?id=CVE-2009-1095
Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers. Desbordamiento de entero en unpack200 en Java SE Development Kit (JDK) y Java Runtime Environment (JRE) v5.0 Update 17 y anteriores, y v6 Update 12 y anteriores, permite a atacantes remotos acceder a ficheros y ejecutar código de su elección a través de un archivo JAR con cabeceras Pack200 manipuladas. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=781 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html http://marc.info/?l=bugtraq&m=124344236 • CWE-189: Numeric Errors •
CVSS: 6.4EPSS: 15%CPEs: 23EXPL: 0CVE-2009-1101 – OpenJDK JAX-WS service endpoint remote Denial-of-Service (6630639)
https://notcve.org/view.php?id=CVE-2009-1101
Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor "leak." Vulnerabilidad no especificada en la implementación del servidor HTTP Lightweight en Java SE Development Kit (JDK) y Java Runtime Environment (JRE) v6 Update 12 y anteriores permite a atacantes remotos provocar una denegación de servicio (probablemente consumo de recursos) para un punto final en el servicio JAX-WS a través de una conexión sin datos, lo que provoca una fuga del descriptor de fichero. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html http://marc.info/?l=bugtraq&m=124344236532162&w=2 http://secunia.com/advisories/34489 http://secunia.com/advisories/34496 http://secunia.com/advisories/34632 http://secunia •
CVSS: 9.3EPSS: 29%CPEs: 153EXPL: 0CVE-2009-1098 – OpenJDK GIF processing buffer overflow vulnerability (6804998)
https://notcve.org/view.php?id=CVE-2009-1098
Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files or execute arbitrary code via a crafted GIF image, aka CR 6804998. Desbordamiento del búfer en Java SE Development Kit (JDK) y Java Runtime Environment (JRE) v5.0 Update 17 y anteriores; v6 Update 12 y anteriores; v1.4.2_19 y anteriores; y 1.3.1_24 y anteriores, permite a atacantes remotos acceder a ficheros o ejecutar código de su elección a través de una imagen GIF manipulada. También se conoce como CR 6804998. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html http://marc.info/?l=bugtraq&m=124344236532162&w=2 http://secunia.com/advisories/34489 http://secunia.co • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 11%CPEs: 91EXPL: 0CVE-2008-5355
https://notcve.org/view.php?id=CVE-2008-5355
The "Java Update" feature for Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the signature of the JRE that is downloaded, which allows remote attackers to execute arbitrary code via DNS man-in-the-middle attacks. La funcionalidad de actualización de Java en Java Runtime Environment (JRE) en Sun JDK y JRE v6 Update 10 y anteriores; en JDK y JRE v5.0 Update 16 y anteriores; y en SDK y JRE v1.4.2_18 y anteriores no verifica la firma del JRE que descarga, permitiendo a atacantes remotos ejecutar código de su elección mediante ataques DNS de man-in-the-middle (hombre en medio). • http://osvdb.org/50498 http://secunia.com/advisories/37386 http://security.gentoo.org/glsa/glsa-200911-02.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-244989-1 http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid= http://www.securitytracker.com/id?1021315 http://www.us-cert.gov/cas/techalerts/TA08-340A.html http://www.vupen.com/english/advisories/2008/3339 http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-0 • CWE-287: Improper Authentication •
CVSS: 7.1EPSS: 6%CPEs: 91EXPL: 0CVE-2008-5348 – OpenJDK Denial-Of-Service in kerberos authentication (6588160)
https://notcve.org/view.php?id=CVE-2008-5348
Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier, when using Kerberos authentication, allows remote attackers to cause a denial of service (OS resource consumption) via unknown vectors. Vulnerabilidad no especificada en Java Runtime Environment (JRE) en Sun JDK y JRE v6 Update 10 y anteriores; JDK y JRE v5.0 Update 16 y anteriores; y SDK y JRE v1.4.2_18 y anteriores, cuando usan la autenticación Kerberos, permite a atacantes remotos provocar una denegación de servicio (consumo de recursos del sistema operativo) mediante vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://marc.info/?l=bugtraq&m=123678756409861&w=2 http://marc.info/?l=bugtraq&m=126583436323697&w=2 http://osvdb.org/50505 http://rhn.redhat.com/errata/RHSA-2008-1018.html http://rh •