Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,088

Export CSV
CVE-2009-2476

OpenJDK OpenType checks can be bypassed (6736293)

The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object.

CVSS 2.0 · 10.0 Critical EPSS 2.9% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Rhel Extras Java Se and 1 more
CVE-2009-2560

Wireshark: various flaws in a) RADIUS, b) Bluetooth L2CAP, c) MIOP dissectors (DoS)

Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissector. NOTE: it was later reported that the RADIUS issue also affects 0.10.13 through 1.0.9.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat Wireshark
Products
Enterprise Linux Wireshark
CVE-2009-2562

Wireshark: Integer overflow in the AFS dissector

Unspecified vulnerability in the AFS dissector in Wireshark 0.9.2 through 1.2.0 allows remote attackers to cause a denial of service (crash) via unknown vectors.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Redhat Wireshark
Products
Enterprise Linux Wireshark
CVE-2009-2563

Wireshark: Null-ptr dereference in the InfiniBand dissector

Unspecified vulnerability in the Infiniband dissector in Wireshark 1.0.6 through 1.2.0, when running on unspecified platforms, allows remote attackers to cause a denial of service (crash) via unknown vectors.

CVSS 2.0 · 7.1 High EPSS 2.6% KEV · Not listed
Vendors
Redhat Wireshark
Products
Enterprise Linux Wireshark
CVE-2009-2625

JDK: XML parsing Denial-Of-Service (6845701)

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

CVSS 2.0 · 5.0 Medium EPSS 30.4% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Xerces2 Java Ubuntu Linux Debian Linux and 15 more
CVE-2009-2632

cyrus-imapd: buffer overflow in cyrus sieve

Buffer overflow in the SIEVE script component (sieve/script.c), as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14, and Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script, related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Cmu Redhat
Products
Cyrus Imap Server Enterprise Linux
CVE-2009-2654

firefox: URL bar spoofing vulnerability

Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.

CVSS 2.0 · 5.8 Medium EPSS 4.7% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Enterprise Linux
CVE-2009-2663

libvorbis: Improper codec headers processing (DoS, ACE)

libvorbis before r16182, as used in Mozilla Firefox 3.5.x before 3.5.2 and other products, allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .ogg file.

CVSS 2.0 · 9.3 Critical EPSS 2.7% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Enterprise Linux
CVE-2009-2664

security flaw

The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.12 allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute arbitrary code via a crafted .js file, related to a "memory safety bug." NOTE: this was originally reported as affecting versions before 3.0.13.

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Enterprise Linux
CVE-2009-2666

fetchmail: SSL null terminator bypass

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS 2.0 · 6.4 Medium EPSS 1.5% KEV · Not listed
Vendors
Fetchmail Redhat
Products
Fetchmail Enterprise Linux
CVE-2009-2670

OpenJDK Untrusted applet System properties access (6738524)

The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-2671

OpenJDK Proxy mechanism information leaks (6801071)

The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-2672

OpenJDK Proxy mechanism information leaks (6801071)

The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors.

CVSS 2.0 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-2673

OpenJDK proxy mechanism allows non-authorized socket connections (6801497)

The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword.

CVSS 2.0 · 7.5 High EPSS 4.8% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-2674

Java Web Start Buffer JPEG processing integer overflow (6823373)

Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 6.4% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-2675

Java Web Start Buffer unpack200 processing integer overflow (6830335)

Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression.

CVSS 2.0 · 10.0 Critical EPSS 4.4% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-2687

php: exif_read_data crash on corrupted JPEG files

The exif_read_data function in the Exif module in PHP before 5.2.10 allows remote attackers to cause a denial of service (crash) via a malformed JPEG image with invalid offset fields, a different issue than CVE-2005-3353.

CVSS 2.0 · 4.3 Medium EPSS 4.4% KEV · Not listed
Vendors
Debian Php Redhat
Products
Debian Linux Php Enterprise Linux
CVE-2009-2689

OpenJDK JDK13Services grants unnecessary privileges (6777448)

JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.

CVSS 2.0 · 10.0 Critical EPSS 2.8% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-2690

OpenJDK private variable information disclosure (6777487)

The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Rhel Extras Java Se and 1 more
CVE-2009-2692

kernel: uninit op in SOCKOPS_WRAP() leads to privesc

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

CVSS 3.1 · 7.8 High EPSS 14.6% KEV · Not listed
Vendors
Debian Linux Redhat and 1 more
Products
Debian Linux Linux Kernel Enterprise Linux and 8 more