Unscored severity · published Aug 5, 2009
CVE-2009-2676
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE…
–
CVSS
3.6%
EPSS
No
On KEV
Description
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Java SE · Sun
All versions, or not specified · source: NVD
JD
Jdk · Sun
through 1.5.0; through 1.6.0; 1.5.0; 1.5.0; 1.5.0; 1.5.0; +27 more · source: NVD
JR
Jre · Sun
through 1.5.0; through 1.6.0; 1.5.0; 1.5.0; 1.5.0; 1.5.0; +34 more · source: NVD
SD
Sdk · Sun
through 1.4.2_21; 1.4.0; 1.4.0_01; 1.4.0_02; 1.4.0_03; 1.4.0_04; +29 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2676
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2676
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
marc.info
http://marc.info/?l=bugtraq&m=125787273209737&w=2
osvdb.org
http://osvdb.org/56789
Vendor Advisory
http://secunia.com/advisories/36176
Vendor Advisory
http://secunia.com/advisories/36199
More from Java SE
–
CVE-2009-2724
Race condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in reflection checks."
–
CVE-2009-2723
Unspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka BugId 6444262
–
CVE-2009-2722
Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429594
–
CVE-2009-2721
Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406003
–
CVE-2009-2720
Unspecified vulnerability in the javax.swing.plaf.synth.SynthContext.isSubregion method in the Swing implementation in Sun Java SE 6 before Update 15 allows context-dependent…