CVE-2009-2719

JDK DoS with crafted .jnlp file

The Java Web Start implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException) via a crafted .jnlp file, as demonstrated by the jnlp_file/appletDesc/index.html#misc test in the Technology Compatibility Kit (TCK) for the Java Network Launching Protocol (JNLP).

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Java Se

CVE-2009-2720

JDK DoS with Swing Synthcontext implementation

Unspecified vulnerability in the javax.swing.plaf.synth.SynthContext.isSubregion method in the Swing implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException in the Jemmy library) via unknown vectors.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Java Se

CVE-2009-2721

JDK Multiple unspecified vulnerabilities in Provider class

Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406003.

CVSS 2.0 · 10.0 Critical EPSS 2.4% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Java Se

CVE-2009-2722

JDK Multiple unspecified vulnerabilities in Provider class (incorrect fix)

Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429594. NOTE: this issue exists because of an incorrect fix for BugId 6406003.

CVSS 2.0 · 10.0 Critical EPSS 2.8% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Java Se

CVE-2009-2723

JDK unspecified deserialization in Provider class

Unspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka BugId 6444262.

CVSS 2.0 · 10.0 Critical EPSS 2.7% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Java Se

CVE-2009-2724

JDK race condition vulnerability reflection checks

Race condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in reflection checks."

CVSS 2.0 · 9.3 Critical EPSS 1.6% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Java Se

CVE-2009-2813

Samba: Share restriction bypass via home-less directory user account(s)

Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories.

CVSS 2.0 · 6.0 Medium EPSS 2.7% KEV · Not listed

Vendors

Apple Fedoraproject Redhat and 1 more

Products

Mac Os X Mac Os X Server Fedora and 3 more

CVE-2009-2906

samba: infinite loop flaw in smbd on unexpected oplock break notification reply

smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet.

CVSS 2.0 · 4.0 Medium EPSS 4.2% KEV · Not listed

Vendors

Canonical Redhat Samba

Products

Ubuntu Linux Enterprise Linux Rhel Extras and 1 more

CVE-2009-2948

samba: information disclosure in suid mount.cifs

mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Rhel Extras Samba

CVE-2009-2979

acroread: Multiple DoS fixes in 8.1.7 (APSB09-15)

Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 do not properly perform XMP-XML entity expansion, which allows remote attackers to cause a denial of service via a crafted document.

CVSS 2.0 · 4.3 Medium EPSS 3.2% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras

CVE-2009-2980

acroread: Multiple arbitrary code execution fixes in 8.1.7 (APSB09-15)

Integer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 8.4% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras

CVE-2009-2981

acroread: Trust Manager restrictions bypass fixed in 8.1.7 (APSB09-15)

Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers to bypass intended Trust Manager restrictions via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.7% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras

CVE-2009-2983

acroread: Multiple arbitrary code execution fixes in 8.1.7 (APSB09-15)

Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 allow attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 12.1% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras

CVE-2009-2985

acroread: Multiple arbitrary code execution fixes in 8.1.7 (APSB09-15)

Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allow attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-2996.

CVSS 2.0 · 9.3 Critical EPSS 5.6% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras

CVE-2009-2986

acroread: Multiple arbitrary code execution fixes in 8.1.7 (APSB09-15)

Multiple heap-based buffer overflows in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 might allow attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 8.3% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras

CVE-2009-2988

acroread: Multiple DoS fixes in 8.1.7 (APSB09-15)

Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which allows attackers to cause a denial of service via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 3.5% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras

CVE-2009-2990

acroread: Multiple arbitrary code execution fixes in 8.1.7 (APSB09-15)

Array index error in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 might allow attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 68.6% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras

CVE-2009-2991

acroread: Multiple arbitrary code execution fixes in 8.1.7 (APSB09-15)

Unspecified vulnerability in the Mozilla plug-in in Adobe Reader and Acrobat 8.x before 8.1.7, and possibly 7.x before 7.1.4 and 9.x before 9.2, might allow remote attackers to execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 7.5% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras

CVE-2009-2993

acroread: Multiple arbitrary code execution fixes in 8.1.7 (APSB09-15)

The JavaScript for Acrobat API in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 does not properly implement the (1) Privileged Context and (2) Safe Path restrictions for unspecified JavaScript methods, which allows remote attackers to create arbitrary files, and possibly execute arbitrary code, via the cPath parameter in a crafted PDF file. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 9.3 Critical EPSS 6.7% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras

CVE-2008-1195

Java-API calls in untrusted Javascript allow network privilege escalation

Unspecified vulnerability in Sun JDK and Java Runtime Environment (JRE) 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to access arbitrary network services on the local host via unspecified vectors related to JavaScript and Java APIs.

CVSS 2.0 · 9.3 Critical EPSS 5.7% KEV · Not listed

Vendors

Canonical Redhat Sun

Products

Ubuntu Linux Network Satellite Rhel Extras and 3 more