// For flags

CVE-2009-3728

OpenJDK ICC_Profile file existence detection information leak (6631533)

Severity Score

5.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Directory traversal vulnerability in the ICC_Profile.getInstance method in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local International Color Consortium (ICC) profile files via a .. (dot dot) in a pathname, aka Bug Id 6631533.

Vulnerabilidad de salto de directorio en el método ICC_Profile.getInstance en Java Runtime Environment (JRE) en Sun Java SE v5.0 anteriores a Update 22 y 6 anteriores a Update 17, y OpenJDK, permite a atacantes remotos saber que existen perfiles locales de color del consorcio internacional del color (IIC) a través de .. (punto punto) en el path, también conocido como Bug Id 6631533.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-10-16 CVE Reserved
  • 2009-11-09 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update1
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update10
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update11
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update12
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update13
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update14
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update15
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update16
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update17
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update18
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update19
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update2
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update20
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update21
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update3
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update4
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update5
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update6
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update7
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update8
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.5.0
Search vendor "Sun" for product "Jre" and version "1.5.0"
update9
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_1
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_2
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update_3
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update10
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update11
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update12
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update13
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update14
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update15
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update16
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update4
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update5
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update6
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update7
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update8
Affected
Sun
Search vendor "Sun"
Jre
Search vendor "Sun" for product "Jre"
1.6.0
Search vendor "Sun" for product "Jre" and version "1.6.0"
update9
Affected
Sun
Search vendor "Sun"
Openjdk
Search vendor "Sun" for product "Openjdk"
*-
Affected