CVE-2009-3881
Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak vulnerability," aka Bug Id 6636650.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.67% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- sun/jre · sun/openjdk
- Source
- secalert@redhat.com
References
- http://java.sun.com/j2se/1.5.0/ReleaseNotes.htmlVendor Advisory
- http://java.sun.com/javase/6/webnotes/6u17.htmlVendor Advisory
- http://secunia.com/advisories/37386
- http://security.gentoo.org/glsa/glsa-200911-02.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
- https://bugzilla.redhat.com/show_bug.cgi?id=530173
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11484
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6906
- http://java.sun.com/j2se/1.5.0/ReleaseNotes.htmlVendor Advisory
- http://java.sun.com/javase/6/webnotes/6u17.htmlVendor Advisory
- http://secunia.com/advisories/37386
- http://security.gentoo.org/glsa/glsa-200911-02.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
- https://bugzilla.redhat.com/show_bug.cgi?id=530173
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11484
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6906
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.