CVSS: 9.8EPSS: 92%CPEs: 339EXPL: 1CVE-2009-3869 – Sun Java Runtime AWT setDifflCM Stack Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2009-3869
04 Nov 2009 — Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357. Desbordamiento de búfer basado en pila en la función setDiffICM en Abstract Window Toolkit (AWT) en Java Runtime Environment (JRE) en S... • https://www.exploit-db.com/exploits/16298 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 7%CPEs: 56EXPL: 0CVE-2009-2625 – JDK: XML parsing Denial-Of-Service (6845701)
https://notcve.org/view.php?id=CVE-2009-2625
06 Aug 2009 — XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework. Apache Xerces2 Java, tal como se utiliza en Sun Java Runtime Environment (JRE) en JDK y JRE v6 anterior a la actualización 15 y el JDK y JRE v5.0 antes de la ... • http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html •
CVSS: 9.1EPSS: 2%CPEs: 61EXPL: 0CVE-2009-2673 – OpenJDK proxy mechanism allows non-authorized socket connections (6801497)
https://notcve.org/view.php?id=CVE-2009-2673
05 Aug 2009 — The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword. El mecanismo proxy implementado en Sun Java Runtime Environment (JRE) en JDK y JRE v6 anteriores Update v15, y JDK y JRE v5.0 anteriores Update v20, permite a atacantes remotos evitar las rest... • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 61EXPL: 0CVE-2009-2670 – OpenJDK Untrusted applet System properties access (6738524)
https://notcve.org/view.php?id=CVE-2009-2670
05 Aug 2009 — The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties. El sistema de audio en Sun Java Runtime Environment (JRE) en JDK y JRE v6 anterior Update v15, y JDK y JRE v5.0 anterior Update v20, no previene el acceso a las prop... • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 3%CPEs: 138EXPL: 0CVE-2009-2676 – JRE applet launcher vulnerability
https://notcve.org/view.php?id=CVE-2009-2676
05 Aug 2009 — Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher. Vulnerabilidad no especificada en JNLPAppletlauncher en Sun Java SE, y SE Business, en JDK y JRE 6v Update v14 y anteriores ... • http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html •
CVSS: 7.5EPSS: 1%CPEs: 61EXPL: 0CVE-2009-2671 – OpenJDK Proxy mechanism information leaks (6801071)
https://notcve.org/view.php?id=CVE-2009-2671
05 Aug 2009 — The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors. El SOCKS proxy implementado en Java Runtime Environment (JRE) en JDK y JRE v6 anterior Update v15, y JDK y JRE v5.0 anterior Update v20, permite a atacantes remotos descubrir la cuenta de usuario que invoca un ... • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20 •
CVSS: 9.8EPSS: 9%CPEs: 27EXPL: 0CVE-2009-2674 – Java Web Start Buffer JPEG processing integer overflow (6823373)
https://notcve.org/view.php?id=CVE-2009-2674
05 Aug 2009 — Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow. Un desbordamiento de enteros en el archivo javaws.exe en Sun Java Web Start en Sun Java Runtime Environment (JRE) en JDK y JRE versión 6 anterior a Update 15, permite a los atacantes dependien... • http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html • CWE-190: Integer Overflow or Wraparound CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 14%CPEs: 61EXPL: 0CVE-2009-2672 – OpenJDK Proxy mechanism information leaks (6801071)
https://notcve.org/view.php?id=CVE-2009-2672
05 Aug 2009 — The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors. El mecanismo proxy implementado en Sun Java Runtime Environment (JRE) en JDK y JRE v6 anterior Update v15, y JDK y JRE v5.0 anterior Update v20, no previene el acceso a las cookies de... • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 8%CPEs: 61EXPL: 0CVE-2009-2675 – Sun Java Pack200 Decoding Inner Class Count Integer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2009-2675
05 Aug 2009 — Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression. Un desbordamiento de enteros en la utilidad unpack200 en Sun Java Runtime Environment (JRE) en JDK y JRE versión 6 anterior a Update 15, y JDK y JRE versión 5.0 ... • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=814 • CWE-190: Integer Overflow or Wraparound CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2009-2030
https://notcve.org/view.php?id=CVE-2009-2030
11 Jun 2009 — Unspecified vulnerability in the XML Digital Signature verification functionality in JVA-RUN in JDK 6.0 in IBM OS/400 i5/OS V5R4M0 and V6R1M0 has unknown impact and attack vectors related to "XML SECURITY PATCH." Una vulnerabilidad no especificada en la funcionalidad de comprobación de XML Digital Signature en JVA-RUN en JDK versión 6.0 en IBM OS/400 i5/OS versiones V5R4M0 y V6R1M0, presenta un impacto y vectores de ataque desconocidos relacionados con "XML SECURITY PATCH". • http://secunia.com/advisories/35356 •