CVE-2009-2673

OpenJDK proxy mechanism allows non-authorized socket connections (6801497)

The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword.

CVSS 2.0 · 7.5 High EPSS 4.8% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2009-2674

Java Web Start Buffer JPEG processing integer overflow (6823373)

Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 6.4% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2009-2675

Java Web Start Buffer unpack200 processing integer overflow (6830335)

Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression.

CVSS 2.0 · 10.0 Critical EPSS 4.4% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2009-2676

JRE applet launcher vulnerability

Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.

CVSS 2.0 · 6.8 Medium EPSS 3.6% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Java Se and 3 more

CVE-2009-2689

OpenJDK JDK13Services grants unnecessary privileges (6777448)

JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.

CVSS 2.0 · 10.0 Critical EPSS 2.8% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more

CVE-2008-5349

OpenJDK RSA public key length denial-of-service (6497740)

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows remote attackers to cause a denial of service (CPU consumption) via a crafted RSA public key.

CVSS 2.0 · 7.1 High EPSS 4.0% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 2 more

CVE-2008-5348

OpenJDK Denial-Of-Service in kerberos authentication (6588160)

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier, when using Kerberos authentication, allows remote attackers to cause a denial of service (OS resource consumption) via unknown vectors.

CVSS 2.0 · 7.1 High EPSS 4.3% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2007-2789

BMP image parser vulnerability

The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.

CVSS 2.0 · 4.3 Medium EPSS 3.5% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2006-3738

openssl get_shared_ciphers overflow

Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.

CVSS 2.0 · 10.0 Critical EPSS 49.9% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Network Satellite

CVE-2008-5346

JRE allows unauthorized memory read access via a crafted ZIP file

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 or earlier allows untrusted applets and applications to read arbitrary memory via a crafted ZIP file.

CVSS 2.0 · 7.1 High EPSS 2.8% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5345

JRE allows unauthorized file access and connections to localhost

Unspecified vulnerability in Java Runtime Environment (JRE) with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier allows code that is loaded from a local filesystem to read arbitrary files and make unauthorized connections to localhost via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2007-2788

Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit

Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 18.2% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-3271

tomcat RemoteFilterValve Information disclosure

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

CVSS 2.0 · 4.3 Medium EPSS 4.8% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Network Satellite

CVE-2008-3114

Java Web Start, untrusted application may determine Cache Location (6704074)

Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.

CVSS 2.0 · 5.0 Medium EPSS 3.1% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2007-2450

tomcat host manager XSS

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

CVSS 2.0 · 3.5 Low EPSS 3.3% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Network Satellite and 1 more

CVE-2006-2940

openssl public key DoS

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.

CVSS 2.0 · 7.8 High EPSS 5.1% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Network Satellite

CVE-2008-3113

Java Web Start arbitrary file creation/deletion file with user permissions (6704077)

Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077.

CVSS 2.0 · 10.0 Critical EPSS 6.4% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-3112

Java Web Start, arbitrary file creation (6703909)

Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.

CVSS 2.0 · 10.0 Critical EPSS 25.7% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2007-2449

tomcat examples jsp XSS

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

CVSS 2.0 · 4.3 Medium EPSS 77.4% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Network Satellite and 1 more

CVE-2008-3111

Java Web Start Buffer overflow vulnerabilities (6557220)

Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.

CVSS 2.0 · 10.0 Critical EPSS 4.3% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more