CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2720 – JDK DoS with Swing Synthcontext implementation
https://notcve.org/view.php?id=CVE-2009-2720
Unspecified vulnerability in the javax.swing.plaf.synth.SynthContext.isSubregion method in the Swing implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException in the Jemmy library) via unknown vectors. Vulnerabilidad no especificada en el método javax.swing.plaf.synth.SynthContext.isSubregion en la implementación de Swing en Sun Java SE v6 anteriores a Update 15 permite a los atacantes dependientes del contexto provocar una denegación de servicio (excepción de puntero nulo en la biblioteca Jemmy) mediante vectores desconocidos. • http://java.sun.com/javase/6/webnotes/6u15.html http://secunia.com/advisories/37386 http://secunia.com/advisories/37460 http://security.gentoo.org/glsa/glsa-200911-02.xml http://www.securityfocus.com/archive/1/507985/100/0/threaded http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://www.vupen.com/english/advisories/2009/3316 https://access.redhat.com/security/cve/CVE-2009-2720 https://bugzilla.redhat.com/show_bug.cgi?id=516823 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2716 – JDK improper version selection
https://notcve.org/view.php?id=CVE-2009-2716
The plugin functionality in Sun Java SE 6 before Update 15 does not properly implement version selection, which allows context-dependent attackers to leverage vulnerabilities in "old zip and certificate handling" and have unspecified other impact via unknown vectors. La funcionalidad de plugin en Sun Java SE v6 versiones anteriores a Update 15 no implementa adecuadamente la selección de versión, permitiendo a atacantes dependientes del contexto aprovechar vulnerabilidades en "gestión antigua de ficheros zip y certificados" y tener otro impacto no especificado mediante vectores desconocidos. • http://java.sun.com/javase/6/webnotes/6u15.html http://secunia.com/advisories/37386 http://secunia.com/advisories/37460 http://security.gentoo.org/glsa/glsa-200911-02.xml http://www.securityfocus.com/archive/1/507985/100/0/threaded http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://www.vupen.com/english/advisories/2009/3316 https://access.redhat.com/security/cve/CVE-2009-2716 https://bugzilla.redhat.com/show_bug.cgi?id=516812 •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2009-2717
https://notcve.org/view.php?id=CVE-2009-2717
The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on Windows 2000 Professional does not provide a Security Warning Icon, which makes it easier for context-dependent attackers to trick a user into interacting unsafely with an untrusted applet. La implementación de Abstract Window Toolkit (AWT) en Sun Java SE v6 anteriores a Update 15 para Windows 2000 Professional no proporciona un Security Warning Icon, facilitando a atacantes dependientes del contexto que engañen a un usuario al interactuar sin seguridad con un applet no confiable. • http://java.sun.com/javase/6/webnotes/6u15.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2721 – JDK Multiple unspecified vulnerabilities in Provider class
https://notcve.org/view.php?id=CVE-2009-2721
Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406003. Múltiples vulnerabilidades no especificadas en la clase "Provider" en Sun Java SE v5.0 anteriores a Update 20 tienen un impacto y vectores de ataque desconocidos, también conocido como BugId 6406003. • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html http://secunia.com/advisories/37386 http://secunia.com/advisories/37460 http://security.gentoo.org/glsa/glsa-200911-02.xml http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1 http://www.securityfocus.com/archive/1/507985/100/0/threaded http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://www.vupen.com/english/advisories/2009/3316 https://access.redhat.com/security/cve/CVE-2009-2721 •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2719 – JDK DoS with crafted .jnlp file
https://notcve.org/view.php?id=CVE-2009-2719
The Java Web Start implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException) via a crafted .jnlp file, as demonstrated by the jnlp_file/appletDesc/index.html#misc test in the Technology Compatibility Kit (TCK) for the Java Network Launching Protocol (JNLP). La implementación de Java Web Start en Sun Java SE v6 anteriores a Update 15 permite a los atacantes dependientes del contexto provocar una denegación de servicio (excepción de puntero nulo) mediante un fichero .jnlp modificado, como se ha demostrado al probar jnlp_file/appletDesc/index.html#misc en el Technology Compatibility Kit (TCK) para el Java Network Launching Protocol (JNLP). • http://java.sun.com/javase/6/webnotes/6u15.html http://secunia.com/advisories/37386 http://secunia.com/advisories/37460 http://security.gentoo.org/glsa/glsa-200911-02.xml http://www.securityfocus.com/archive/1/507985/100/0/threaded http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://www.vupen.com/english/advisories/2009/3316 https://access.redhat.com/security/cve/CVE-2009-2719 https://bugzilla.redhat.com/show_bug.cgi?id=516820 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •