CVE-2009-2670
The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which…
Does this matter?
Lower severity and a low EPSS score (3.29%). Track it; it rarely justifies an emergency change on its own.
Description
The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 3.29% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- sun/jdk · sun/jre
- Source
- cve@mitre.org
References
- http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20
- http://java.sun.com/javase/6/webnotes/6u15.html
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
- http://marc.info/?l=bugtraq&m=125787273209737&w=2
- http://osvdb.org/56788
- http://secunia.com/advisories/36162
- http://secunia.com/advisories/36176
- http://secunia.com/advisories/36180
- http://secunia.com/advisories/36199
- http://secunia.com/advisories/36248
- http://secunia.com/advisories/37300
- http://secunia.com/advisories/37386
- http://secunia.com/advisories/37460
- http://security.gentoo.org/glsa/glsa-200911-02.xml
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1Patch
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1Patch, Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
- http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
- http://www.securityfocus.com/archive/1/507985/100/0/threaded
- http://www.securityfocus.com/bid/35939
- http://www.securitytracker.com/id?1022658
- http://www.us-cert.gov/cas/techalerts/TA09-294A.htmlUS Government Resource
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://www.vupen.com/english/advisories/2009/2543
- http://www.vupen.com/english/advisories/2009/3316
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52306
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.