CVE-2009-3880
OpenJDK UI logging information leakage(6664512)
Severity Score
5.0
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager, aka Bug Id 6664512.
El Abstract Window Toolkit (AWT) en Java Runtime Environment (JRE) en Sun Java SE v5.0 anteriores a Update 22 y 6 anteriores a Update 17, y OpenJDK, no restringen de forma adecuada los objetos que se pueden enviar a los usuarios que se loguean, lo que permite a atacantes remotos obtener información sensible a través de vectores relativos a la implementación del componente KeyboardFocusManager, y DefaultKeyboardFocusManager, también conocido como Bug Id 6664512.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2009-11-05 CVE Reserved
- 2009-11-09 CVE Published
- 2024-05-09 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/37386 | Third Party Advisory | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10761 | Signature | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7316 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://java.sun.com/j2se/1.5.0/ReleaseNotes.html | 2017-09-19 | |
| http://java.sun.com/javase/6/webnotes/6u17.html | 2017-09-19 | |
| http://security.gentoo.org/glsa/glsa-200911-02.xml | 2017-09-19 | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2010:084 | 2017-09-19 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=530296 | 2009-12-11 | |
| https://access.redhat.com/security/cve/CVE-2009-3880 | 2009-12-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | <= 1.5.0 Search vendor "Sun" for product "Jre" and version " <= 1.5.0" | update_21 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | <= 1.6.0 Search vendor "Sun" for product "Jre" and version " <= 1.6.0" | update_16 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_1 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_11 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_12 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_13 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_14 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_15 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_16 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_17 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_18 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_19 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_2 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_20 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_3 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_4 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_5 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_6 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_7 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_8 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update_9 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0" | update10 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_1 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_10 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_11 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_12 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_13 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_14 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_15 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_2 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_3 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_4 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_5 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_6 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_7 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_8 |
Affected
| ||||||
| Sun Search vendor "Sun" | Jre Search vendor "Sun" for product "Jre" | 1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0" | update_9 |
Affected
| ||||||
| Sun Search vendor "Sun" | Openjdk Search vendor "Sun" for product "Openjdk" | * | - |
Affected
| ||||||