VulnerabilityModified

CVE-2009-2843

Java for Mac OS X 10.5 before Update 6 and 10.6 before Update 1 accepts expired certificates for applets, which makes it easier for remote attackers to execute arbitrary code via an applet.

MEDIUM 5.0EPSS 2.11%

Does this matter?

Lower severity and a low EPSS score (2.11%). Track it; it rarely justifies an emergency change on its own.

Description

Java for Mac OS X 10.5 before Update 6 and 10.6 before Update 1 accepts expired certificates for applets, which makes it easier for remote attackers to execute arbitrary code via an applet.

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS: 2.11% probability · 81th percentile
CISA KEV: Not listed
Weakness: CWE-310
Affected: apple/mac os x · apple/mac os x server
Source: cve@mitre.org

References

http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.htmlPatch, Vendor Advisory
http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.htmlPatch, Vendor Advisory
http://secunia.com/advisories/37581Vendor Advisory
http://support.apple.com/kb/HT3969Patch, Vendor Advisory
http://support.apple.com/kb/HT3970Patch, Vendor Advisory
http://www.securityfocus.com/bid/37206Patch
http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.htmlPatch, Vendor Advisory
http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.htmlPatch, Vendor Advisory
http://secunia.com/advisories/37581Vendor Advisory
http://support.apple.com/kb/HT3969Patch, Vendor Advisory
http://support.apple.com/kb/HT3970Patch, Vendor Advisory
http://www.securityfocus.com/bid/37206Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.