CVE-2009-1093

OpenJDK remote LDAP Denial-Of-Service (6717680)

LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 3 more

CVE-2009-1094

OpenJDK LDAP client remote code execution (6737315)

Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier allows remote LDAP servers to execute arbitrary code via unknown vectors related to serialized data.

CVSS 2.0 · 10.0 Critical EPSS 4.4% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 3 more

CVE-2009-1095

OpenJDK Pack200 Buffer overflow vulnerability (6792554)

Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.

CVSS 2.0 · 10.0 Critical EPSS 7.1% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2009-1096

OpenJDK Pack200 Buffer overflow vulnerability (6792554)

Buffer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.

CVSS 2.0 · 10.0 Critical EPSS 8.2% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2009-1097

OpenJDK: PNG and GIF processing buffer overflow vulnerabilities (6804996, 6804997)

Multiple buffer overflows in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allow remote attackers to access files or execute arbitrary code via (1) a crafted PNG image that triggers an integer overflow during memory allocation for display on the splash screen, aka CR 6804996; and (2) a crafted GIF image from which unspecified values are used in calculation of offsets, leading to object-pointer corruption, aka CR 6804997.

CVSS 2.0 · 9.3 Critical EPSS 7.1% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2009-1098

OpenJDK GIF processing buffer overflow vulnerability (6804998)

Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files or execute arbitrary code via a crafted GIF image, aka CR 6804998.

CVSS 2.0 · 9.3 Critical EPSS 6.8% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 3 more

CVE-2009-1099

OpenJDK: Type1 font processing buffer overflow vulnerability

Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow.

CVSS 2.0 · 7.5 High EPSS 5.7% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Java Runtime Environment and 1 more

CVE-2009-1100

OpenJDK: DoS (disk consumption) via handling of temporary font files

Multiple unspecified vulnerabilities in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allow remote attackers to cause a denial of service (disk consumption) via vectors related to temporary font files and (1) "limits on Font creation," aka CR 6522586, and (2) another unspecified vector, aka CR 6632886.

CVSS 2.0 · 5.0 Medium EPSS 3.6% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 2 more

CVE-2009-1101

OpenJDK JAX-WS service endpoint remote Denial-of-Service (6630639)

Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor "leak."

CVSS 2.0 · 5.0 Medium EPSS 3.6% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2009-1103

OpenJDK: Files disclosure, arbitrary code execution via "deserializing applets" (6646860)

Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to "deserializing applets," aka CR 6646860.

CVSS 2.0 · 6.4 Medium EPSS 4.5% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Java

CVE-2009-1104

OpenJDK: Intended access restrictions bypass via LiveConnect (6724331)

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent Javascript that is loaded from the localhost from connecting to other ports on the system, which allows user-assisted attackers to bypass intended access restrictions via LiveConnect, aka CR 6724331. NOTE: this vulnerability can be leveraged with separate cross-site scripting (XSS) vulnerabilities for remote attack vectors.

CVSS 2.0 · 5.8 Medium EPSS 2.2% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Java

CVE-2009-1105

OpenJDK: Possibility of trusted applet run in older, vulnerable version of JRE (6706490)

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to cause a trusted applet to run in an older JRE version, which can be used to exploit vulnerabilities in that older version, aka CR 6706490.

CVSS 2.0 · 7.5 High EPSS 3.6% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Java

CVE-2009-1106

OpenJDK: Improper parsing of crossdomain.xml files (intended access restriction bypass) (6798948)

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.

CVSS 2.0 · 6.4 Medium EPSS 3.6% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2009-1107

OpenJDK: Signed applet remote misuse possibility (6782871)

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier, and 5.0 Update 17 and earlier, allows remote attackers to trick a user into trusting a signed applet via unknown vectors that misrepresent the security warning dialog, related to a "Swing JLabel HTML parsing vulnerability," aka CR 6782871.

CVSS 2.0 · 4.3 Medium EPSS 2.8% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Java

CVE-2009-2409

deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

CVSS 2.0 · 5.1 Medium EPSS 4.3% KEV · Not listed

Vendors

Gnu Mozilla Openssl and 1 more

Products

Gnutls Network Security Services Openssl and 4 more

CVE-2009-2475

OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,6660049,6660539,6813167)

Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.

CVSS 2.0 · 7.8 High EPSS 2.3% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2009-2625

JDK: XML parsing Denial-Of-Service (6845701)

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

CVSS 2.0 · 5.0 Medium EPSS 30.4% KEV · Not listed

Vendors

Apache Canonical Debian and 5 more

Products

Xerces2 Java Ubuntu Linux Debian Linux and 15 more

CVE-2009-2670

OpenJDK Untrusted applet System properties access (6738524)

The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2009-2671

OpenJDK Proxy mechanism information leaks (6801071)

The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2008-5354

OpenJDK Privilege escalation in command line applications (6733959)

Stack-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows locally-launched and possibly remote untrusted Java applications to execute arbitrary code via a JAR file with a long Main-Class manifest entry.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more