CVE-2009-3867: sun jdk

Modified

Published 05-11-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-3867 is a high (CVSS 9.3) vulnerability in sun jdk. EPSS estimates a 73.19% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 4 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 20-09-2010)

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

73.19%

0%100%

Critical · -0.18 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits4exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 7

RHSA-2009:1560 RHSA-2009:1571 RHSA-2009:1643 RHSA-2009:1647 RHSA-2009:1694 RHSA-2010:0043+1 more

Timeline

05-11-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

73.19%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

Decrease -0.18 pp

From 73.38% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

4 found

exploit-databaseremotelinuxVerified
Sun Java SE November 2009 - Multiple Vulnerabilities (1)
Maturity: weaponized
exploit-databaseremotemultipleVerified
Sun Java JRE - getSoundbank 'file://' URI Buffer Overflow (Metasploit)
Maturity: weaponized
exploit-databaseremotemultipleVerified
Sun Java SE November 2009 - Multiple Vulnerabilities (2)
Maturity: weaponized

Show all 4 exploits

MetasploitremoteVerified
Sun Java JRE getSoundbank file:// URI Buffer Overflow
exploit/multi/browser/java_getsoundbank_bof
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Sun3 products

jdk1.5.0:update_1 | 1.5.0:update_10 | 1.5.0:update_11 | 1.5.0:update_12 | 1.5.0:update_13 | 1.5.0:update_14 | 1.5.0:update_15 | 1.5.0:update_16 | 1.5.0:update_17 | 1.5.0:update_18 | 1.5.0:update_19 | 1.5.0:update_2 | 1.5.0:update_20 | 1.5.0:update_21 | 1.5.0:update_3 | 1.5.0:update_4 | 1.5.0:update_5 | 1.5.0:update_6 | 1.5.0:update_7 | 1.5.0:update_8 | 1.5.0:update_9 | 1.6.0:update_1 | 1.6.0:update_10 | 1.6.0:update_11 | 1.6.0:update_12 | 1.6.0:update_13 | 1.6.0:update_14 | 1.6.0:update_15 | 1.6.0:update_16 | 1.6.0:update_3 | 1.6.0:update_4 | 1.6.0:update_5 | 1.6.0:update_6 | 1.6.0:update_7 | 1.6.0:update_8 | 1.6.0:update_9 | 1.6.0:update2
jre1.5.0:update_1 | 1.5.0:update_11 | 1.5.0:update_12 | 1.5.0:update_13 | 1.5.0:update_14 | 1.5.0:update_15 | 1.5.0:update_16 | 1.5.0:update_17 | 1.5.0:update_18 | 1.5.0:update_19 | 1.5.0:update_2 | 1.5.0:update_20 | 1.5.0:update_21 | 1.5.0:update_3 | 1.5.0:update_4 | 1.5.0:update_5 | 1.5.0:update_6 | 1.5.0:update_7 | 1.5.0:update_8 | 1.5.0:update_9 | 1.6.0:update_1 | 1.6.0:update_10 | 1.6.0:update_11 | 1.6.0:update_12 | 1.6.0:update_13 | 1.6.0:update_14 | 1.6.0:update_15 | 1.6.0:update_16 | 1.6.0:update_2 | 1.6.0:update_3 | 1.6.0:update_4 | 1.6.0:update_5 | 1.6.0:update_6 | 1.6.0:update_7 | 1.6.0:update_8 | 1.6.0:update_9 | 1.4.2_1 | 1.4.2_2 | 1.4.2_02 | 1.4.2_03 | 1.4.2_3 | 1.4.2_4 | 1.4.2_04 | 1.4.2_05 | 1.4.2_5 | 1.4.2_06 | 1.4.2_6 | 1.4.2_7 | 1.4.2_07 | 1.4.2_8 | 1.4.2_08 | 1.4.2_09 | 1.4.2_9 | 1.4.2_10 | 1.4.2_11 | 1.4.2_12 | 1.4.2_13 | 1.4.2_14 | 1.4.2_15 | 1.4.2_16 | 1.4.2_17 | 1.4.2_18 | 1.4.2_19 | 1.4.2_20 | 1.4.2_21 | 1.4.2_22 | 1.3.1_1 | 1.3.1_01 | 1.3.1_01a | 1.3.1_02 | 1.3.1_2 | 1.3.1_03 | 1.3.1_3 | 1.3.1_4 | 1.3.1_04 | 1.3.1_05 | 1.3.1_5 | 1.3.1_06 | 1.3.1_6 | 1.3.1_07 | 1.3.1_7 | 1.3.1_8 | 1.3.1_08 | 1.3.1_9 | 1.3.1_09 | 1.3.1_10 | 1.3.1_11 | 1.3.1_12 | 1.3.1_13 | 1.3.1_14 | 1.3.1_15 | 1.3.1_16 | 1.3.1_17 | 1.3.1_18 | 1.3.1_19 | 1.3.1_20 | 1.3.1_21 | 1.3.1_22 | 1.3.1_23 | 1.3.1_24 | 1.3.1_25 | 1.4.2_01
sdk1.4.2_01 | 1.4.2_1 | 1.4.2_2 | 1.4.2_02 | 1.4.2_03 | 1.4.2_3 | 1.4.2_04 | 1.4.2_4 | 1.4.2_5 | 1.4.2_05 | 1.4.2_6 | 1.4.2_06 | 1.4.2_07 | 1.4.2_7 | 1.4.2_8 | 1.4.2_08 | 1.4.2_09 | 1.4.2_9 | 1.4.2_10 | 1.4.2_11 | 1.4.2_12 | 1.4.2_13 | 1.4.2_14 | 1.4.2_15 | 1.4.2_16 | 1.4.2_17 | 1.4.2_18 | 1.4.2_19 | 1.4.2_20 | 1.4.2_21 | 1.4.2_22 | 1.3.1_01 | 1.3.1_01a | 1.3.1_2 | 1.3.1_02 | 1.3.1_03 | 1.3.1_3 | 1.3.1_4 | 1.3.1_04 | 1.3.1_5 | 1.3.1_05 | 1.3.1_6 | 1.3.1_06 | 1.3.1_7 | 1.3.1_07 | 1.3.1_8 | 1.3.1_08 | 1.3.1_9 | 1.3.1_09 | 1.3.1_10 | 1.3.1_11 | 1.3.1_12 | 1.3.1_13 | 1.3.1_14 | 1.3.1_15 | 1.3.1_16 | 1.3.1_17 | 1.3.1_18 | 1.3.1_19 | 1.3.1_20 | 1.3.1_21 | 1.3.1_22 | 1.3.1_23 | 1.3.1_24 | 1.3.1_25

1 vendor · 3 products

References

25 links

zerodayinitiative.com/advisories/ZDI-09-076/X Refsource MISCPatch
marc.info?l=bugtraq&m=126566824131534&w=2Vendor AdvisoryX Refsource HP
www.securityfocus.com/bid/36881VDB EntryX Refsource BID
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6746VDB EntrySignatureX Refsource OVAL
support.apple.com/kb/HT3970X Refsource CONFIRM
marc.info?l=bugtraq&m=134254866602253&w=2Vendor AdvisoryX Refsource HP
support.apple.com/kb/HT3969X Refsource CONFIRM
marc.info?l=bugtraq&m=131593453929393&w=2Vendor AdvisoryX Refsource HP
security.gentoo.org/glsa/glsa-200911-02.xmlVendor AdvisoryX Refsource GENTOO
www.redhat.com/support/errata/RHSA-2009-1694.htmlVendor AdvisoryX Refsource REDHAT

Show all 25 references

lists.apple.com/archives/security-announce/2009/Dec/msg00000.htmlVendor AdvisoryX Refsource APPLE
secunia.com/advisories/37231Third Party AdvisoryX Refsource SECUNIAVendor Advisory
securitytracker.com/id?1023132VDB EntryX Refsource SECTRACKVendor Advisory
lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.htmlVendor AdvisoryX Refsource SUSE
sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1Vendor AdvisoryX Refsource SUNALERTPatch
www.vupen.com/english/advisories/2009/3131VDB EntryX Refsource VUPENPatchVendor Advisory
lists.apple.com/archives/security-announce/2009/Dec/msg00001.htmlVendor AdvisoryX Refsource APPLE
secunia.com/advisories/37581Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11903VDB EntrySignatureX Refsource OVAL
www.oracle.com/technetwork/topics/security/cpujan2010-084891.htmlX Refsource CONFIRM
java.sun.com/javase/6/webnotes/6u17.htmlX Refsource CONFIRMVendor Advisory
secunia.com/advisories/37841Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/37239Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7750VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/37386Third Party AdvisoryX Refsource SECUNIA