CVE-2009-2675

Aliases:CGA-33wg-2v82-6vj3CGA-3f84-8vrf-9qh7CGA-3hpc-7vj7-fw2cCGA-3pxr-pq3f-xcrpCGA-3w6h-6754-g67gCGA-46jg-482h-56pvCGA-4cjg-6vwh-58p4CGA-4gw3-cc5r-gmc8CGA-4h44-6rrm-p6j2CGA-4jr9-f2pq-836hCGA-4pv2-7xpq-rmg7CGA-4rr6-m7jg-g79jCGA-529p-j232-36wxCGA-55pf-wjwq-vhjwCGA-55x6-xr6p-5755CGA-5g8m-xr4h-wh67CGA-5jfw-3844-73w3CGA-6g2j-38pv-hcmcCGA-6j4m-h9vq-5pg3CGA-6p46-pxh7-6324CGA-6x67-wcw4-955gCGA-7mc9-9c7x-4644CGA-82jr-vq65-7565CGA-85m7-gfcr-wf73CGA-8p38-x6rw-7wwfCGA-8xfr-xpqg-47qmCGA-92wm-5f3c-264hCGA-933f-fpv8-m88rCGA-99x8-jfw6-wr3pCGA-9q6q-2wvp-8x8vCGA-9rvr-cg38-rxf4CGA-9w2x-385c-f7j9CGA-c4m3-j3x4-258qCGA-c54g-ccqm-4xxrCGA-c6jp-rr7x-g8c8CGA-c9pr-776v-m2vqCGA-cfwc-53j9-qmgvCGA-cv2q-jh8x-6jmmCGA-cwxj-f4mv-vfvgCGA-f43v-w23j-qhh5CGA-f8vq-pxq2-mvx3CGA-f92q-cp2f-ff35CGA-g6rq-8hqq-mg5wCGA-g7cw-frvf-f3q4CGA-gv62-9rpp-gx7qCGA-h25x-4j4q-h5c8CGA-hmwh-3f46-v38hCGA-hv86-24rr-4xh4CGA-j6j8-j922-2g2pCGA-j9fv-cqhh-qgj8CGA-jcvp-6mw6-h2fcCGA-jh4p-c94f-w7m5CGA-mg47-p5pm-f54wCGA-mhjq-g4hg-m5fpCGA-mm37-p7qf-9ww8CGA-mq7v-77ff-xq62CGA-mqhx-hpm2-vjm3CGA-p3p6-6wm4-24qmCGA-p6p3-gr5g-j5jxCGA-p6rx-5gc5-5ph7CGA-pq95-p97q-vfvvCGA-prf5-g5cw-5743CGA-px3r-pmfh-8mp6CGA-q78j-h9w5-5x32CGA-qfq8-rjr4-mrfqCGA-qgh3-r2wq-r3c6CGA-qgxf-q2p6-39v5CGA-qvp4-r9m3-gcmgCGA-qwf8-vh85-8mmwCGA-rchq-6h3v-78vmCGA-w29g-jff7-h622CGA-w65w-9v99-3f57CGA-w9cx-f554-2946CGA-wv7f-777f-jf4jCGA-x2p8-6v2j-vw8hCGA-x49m-cfg4-hg8gCGA-xp7q-6xr3-gc8pCGA-xrwg-2qww-24qp
Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 05 Aug 2009, 19:00
Last modified:07 Aug 2024, 05:59

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
10 HIGH
v2.0 (nvd)
EPSS Score
4.36% LOW
4% probability -2.47%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Aug 2009, 19:00
Published
Vulnerability first disclosed
07 Aug 2024, 05:59
Last Modified
Vulnerability information updated

Description

Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression.

CVSS Metrics

  • v2.0•HIGH•Score: 10AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 4.36%• Percentile: 91%

Techniques & Countermeasures

  • CWE-264•Permissions, Privileges, and Access Controls

    Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected Systems

  • chainguard•openjdk-11-openj9

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-dbg

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-default-jdk

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-default-jvm

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-doc

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-jmods

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-jre

    < 0.59.0-r2

  • chainguard•openjdk-17-openj9

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-dbg

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-default-jdk

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-default-jvm

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-doc

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-jmods

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-jre

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-dbg

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-default-jdk

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-default-jvm

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-doc

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-jmods

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-jre

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9-dbg

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9-default-jdk

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9-default-jvm

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9-jmods

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9-jre

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9-dbg

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9-default-jdk

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9-default-jvm

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9-jmods

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9-jre

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9-dbg

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9-default-jdk

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9-default-jvm

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9-doc

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9-jre

    < 0.59.0-r1

  • sun•jdk

    ≤ 6 | 5.0:update_1 | 5.0:update_10 | 5.0:update_11 | 5.0:update_12 | 5.0:update_13 | 5.0:update_14 | 5.0:update_15 | 5.0:update_16 | 5.0:update_17 | 5.0:update_2 | 5.0:update_3 | 5.0:update_4 | 5.0:update_5 | 5.0:update_6 | 5.0:update_7 | 5.0:update_8 | 5.0:update_9 | 6:update_1 | 6:update_10 | 6:update_11 | 6:update_12 | 6:update_2 | 6:update_3 | 6:update_4 | 6:update_5 | 6:update_6 | 6:update_7 | 6:update_8 | 6:update_9

  • sun•jre

    ≤ 6 | 5.0:update_1 | 5.0:update_10 | 5.0:update_11 | 5.0:update_12 | 5.0:update_13 | 5.0:update_14 | 5.0:update_15 | 5.0:update_16 | 5.0:update_17 | 5.0:update_19 | 5.0:update_2 | 5.0:update_3 | 5.0:update_4 | 5.0:update_5 | 5.0:update_6 | 5.0:update_7 | 5.0:update_8 | 5.0:update_9 | 6:update_1 | 6:update_10 | 6:update_11 | 6:update_12 | 6:update_2 | 6:update_3 | 6:update_4 | 6:update_5 | 6:update_6 | 6:update_7 | 6:update_8 | 6:update_9

References (33)