CVE-2009-1099: sun java_runtime_environment Numeric Errors

Modified

Published 25-03-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-1099 is a high (CVSS 7.5) Numeric Errors vulnerability in sun java_runtime_environment. EPSS estimates a 5.66% chance of exploitation in the next 30 days, higher than 92.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

5.66%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6

RHSA-2009:0392 RHSA-2009:0394 RHSA-2009:1038 RHSA-2009:1198 RHSA-2009:1662 RHSA-2010:0043

Timeline

25-03-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

5.66%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.66% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-189Numeric ErrorsWeaknesses in this category are related to improper calculation or conversion of numbers.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Sun1 product

java_runtime_environment5.0 | 6.0

1 vendor · 1 product

References

34 links

lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.htmlVendor AdvisoryX Refsource SUSE
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5726VDB EntrySignatureX Refsource OVAL
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133Vendor AdvisoryX Refsource HP
secunia.com/advisories/35156Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/35776Third Party AdvisoryX Refsource SECUNIAVendor Advisory
support.avaya.com/elmodocs2/security/ASA-2009-109.htmX Refsource CONFIRM
www.securitytracker.com/id?1021913VDB EntryX Refsource SECTRACK
secunia.com/advisories/37460Third Party AdvisoryX Refsource SECUNIAVendor Advisory
security.gentoo.org/glsa/glsa-200911-02.xmlVendor AdvisoryX Refsource GENTOO

Show all 34 references

www.redhat.com/support/errata/RHSA-2009-1038.htmlVendor AdvisoryX Refsource REDHAT
labs.idefense.com/intelligence/vulnerabilities/display.php?id=777Third Party AdvisoryX Refsource IDEFENSE
rhn.redhat.com/errata/RHSA-2009-1198.htmlVendor AdvisoryX Refsource REDHAT
www.vmware.com/security/advisories/VMSA-2009-0016.htmlX Refsource CONFIRM
marc.info?l=bugtraq&m=124344236532162&w=2Vendor AdvisoryX Refsource HP
www.redhat.com/support/errata/RHSA-2009-0394.htmlVendor AdvisoryX Refsource REDHAT
sunsolve.sun.com/search/document.do?assetkey=1-26-254571-1Vendor AdvisoryX Refsource SUNALERTPatch
secunia.com/advisories/34495Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/36185Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/35255Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2009/1426VDB EntryX Refsource VUPENVendor Advisory
lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlVendor AdvisoryX Refsource SUSE
www.securityfocus.com/archive/1/507985/100/0/threadedMailing ListX Refsource BUGTRAQ
www.oracle.com/technetwork/topics/security/cpujul2009-091332.htmlX Refsource CONFIRM
www.redhat.com/support/errata/RHSA-2009-0392.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/35223Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/34240VDB EntryX Refsource BID
secunia.com/advisories/34496Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/35416Third Party AdvisoryX Refsource SECUNIAVendor Advisory
sunsolve.sun.com/search/document.do?assetkey=1-21-118669-19-1X Refsource MISCPatchVendor Advisory
support.avaya.com/elmodocs2/security/ASA-2009-108.htmX Refsource CONFIRM
secunia.com/advisories/37386Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.htmlVendor AdvisoryX Refsource SUSE
www.vupen.com/english/advisories/2009/3316VDB EntryX Refsource VUPENVendor Advisory