Lucene search
MitreCVE-2009-3874HistoryNov 05, 2009 - 4:30 p.m.
CVE-2009-3874
2009-11-0516:30:00
CWE-189
mitre
web.nvd.nist.gov
69
java se
integer overflow
jpegimagereader
remote code execution
cve-2009-3874
CVSS2
9.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
AI Score
7.8
Confidence
Low
EPSS
0.314
Percentile
97.0%
Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensions in a JPEG file that triggers a heap-based buffer overflow, aka Bug Id 6874643.
Affected configurations
Node
sunjdkMatch1.5.0update_1
ORsunjdkMatch1.5.0update_10
ORsunjdkMatch1.5.0update_11
ORsunjdkMatch1.5.0update_12
ORsunjdkMatch1.5.0update_13
ORsunjdkMatch1.5.0update_14
ORsunjdkMatch1.5.0update_15
ORsunjdkMatch1.5.0update_16
ORsunjdkMatch1.5.0update_17
ORsunjdkMatch1.5.0update_18
ORsunjdkMatch1.5.0update_19
ORsunjdkMatch1.5.0update_2
ORsunjdkMatch1.5.0update_20
ORsunjdkMatch1.5.0update_21
ORsunjdkMatch1.5.0update_3
ORsunjdkMatch1.5.0update_4
ORsunjdkMatch1.5.0update_5
ORsunjdkMatch1.5.0update_6
ORsunjdkMatch1.5.0update_7
ORsunjdkMatch1.5.0update_8
ORsunjdkMatch1.5.0update_9
ORsunjdkMatch1.6.0update_1
ORsunjdkMatch1.6.0update_10
ORsunjdkMatch1.6.0update_11
ORsunjdkMatch1.6.0update_12
ORsunjdkMatch1.6.0update_13
ORsunjdkMatch1.6.0update_14
ORsunjdkMatch1.6.0update_15
ORsunjdkMatch1.6.0update_16
ORsunjdkMatch1.6.0update_3
ORsunjdkMatch1.6.0update_4
ORsunjdkMatch1.6.0update_5
ORsunjdkMatch1.6.0update_6
ORsunjdkMatch1.6.0update_7
ORsunjdkMatch1.6.0update_8
ORsunjdkMatch1.6.0update_9
ORsunjreMatch1.5.0update_1
ORsunjreMatch1.5.0update_11
ORsunjreMatch1.5.0update_12
ORsunjreMatch1.5.0update_13
ORsunjreMatch1.5.0update_14
ORsunjreMatch1.5.0update_15
ORsunjreMatch1.5.0update_16
ORsunjreMatch1.5.0update_17
ORsunjreMatch1.5.0update_18
ORsunjreMatch1.5.0update_19
ORsunjreMatch1.5.0update_2
ORsunjreMatch1.5.0update_20
ORsunjreMatch1.5.0update_21
ORsunjreMatch1.5.0update_3
ORsunjreMatch1.5.0update_4
ORsunjreMatch1.5.0update_5
ORsunjreMatch1.5.0update_6
ORsunjreMatch1.5.0update_7
ORsunjreMatch1.5.0update_8
ORsunjreMatch1.5.0update_9
ORsunjreMatch1.6.0update_1
ORsunjreMatch1.6.0update_10
ORsunjreMatch1.6.0update_11
ORsunjreMatch1.6.0update_12
ORsunjreMatch1.6.0update_13
ORsunjreMatch1.6.0update_14
ORsunjreMatch1.6.0update_15
ORsunjreMatch1.6.0update_16
ORsunjreMatch1.6.0update_2
ORsunjreMatch1.6.0update_3
ORsunjreMatch1.6.0update_4
ORsunjreMatch1.6.0update_5
ORsunjreMatch1.6.0update_6
ORsunjreMatch1.6.0update_7
ORsunjreMatch1.6.0update_8
ORsunjreMatch1.6.0update_9
Node
sunjreMatch1.4.2_1
ORsunjreMatch1.4.2_2
ORsunjreMatch1.4.2_02
ORsunjreMatch1.4.2_03
ORsunjreMatch1.4.2_3
ORsunjreMatch1.4.2_4
ORsunjreMatch1.4.2_04
ORsunjreMatch1.4.2_05
ORsunjreMatch1.4.2_5
ORsunjreMatch1.4.2_06
ORsunjreMatch1.4.2_6
ORsunjreMatch1.4.2_7
ORsunjreMatch1.4.2_07
ORsunjreMatch1.4.2_8
ORsunjreMatch1.4.2_08
ORsunjreMatch1.4.2_09
ORsunjreMatch1.4.2_9
ORsunjreMatch1.4.2_10
ORsunjreMatch1.4.2_11
ORsunjreMatch1.4.2_12
ORsunjreMatch1.4.2_13
ORsunjreMatch1.4.2_14
ORsunjreMatch1.4.2_15
ORsunjreMatch1.4.2_16
ORsunjreMatch1.4.2_17
ORsunjreMatch1.4.2_18
ORsunjreMatch1.4.2_19
ORsunjreMatch1.4.2_20
ORsunjreMatch1.4.2_21
ORsunjreMatch1.4.2_22
ORsunsdkMatch1.4.2_01
ORsunsdkMatch1.4.2_1
ORsunsdkMatch1.4.2_2
ORsunsdkMatch1.4.2_02
ORsunsdkMatch1.4.2_03
ORsunsdkMatch1.4.2_3
ORsunsdkMatch1.4.2_04
ORsunsdkMatch1.4.2_4
ORsunsdkMatch1.4.2_5
ORsunsdkMatch1.4.2_05
ORsunsdkMatch1.4.2_6
ORsunsdkMatch1.4.2_06
ORsunsdkMatch1.4.2_07
ORsunsdkMatch1.4.2_7
ORsunsdkMatch1.4.2_8
ORsunsdkMatch1.4.2_08
ORsunsdkMatch1.4.2_09
ORsunsdkMatch1.4.2_9
ORsunsdkMatch1.4.2_10
ORsunsdkMatch1.4.2_11
ORsunsdkMatch1.4.2_12
ORsunsdkMatch1.4.2_13
ORsunsdkMatch1.4.2_14
ORsunsdkMatch1.4.2_15
ORsunsdkMatch1.4.2_16
ORsunsdkMatch1.4.2_17
ORsunsdkMatch1.4.2_18
ORsunsdkMatch1.4.2_19
ORsunsdkMatch1.4.2_20
ORsunsdkMatch1.4.2_21
ORsunsdkMatch1.4.2_22
sunsolaris
Node
sunjreMatch1.3.1_1
ORsunjreMatch1.3.1_01
ORsunjreMatch1.3.1_01a
ORsunjreMatch1.3.1_02
ORsunjreMatch1.3.1_2
ORsunjreMatch1.3.1_03
ORsunjreMatch1.3.1_3
ORsunjreMatch1.3.1_4
ORsunjreMatch1.3.1_04
ORsunjreMatch1.3.1_05
ORsunjreMatch1.3.1_5
ORsunjreMatch1.3.1_06
ORsunjreMatch1.3.1_6
ORsunjreMatch1.3.1_07
ORsunjreMatch1.3.1_7
ORsunjreMatch1.3.1_8
ORsunjreMatch1.3.1_08
ORsunjreMatch1.3.1_9
ORsunjreMatch1.3.1_09
ORsunjreMatch1.3.1_10
ORsunjreMatch1.3.1_11
ORsunjreMatch1.3.1_12
ORsunjreMatch1.3.1_13
ORsunjreMatch1.3.1_14
ORsunjreMatch1.3.1_15
ORsunjreMatch1.3.1_16
ORsunjreMatch1.3.1_17
ORsunjreMatch1.3.1_18
ORsunjreMatch1.3.1_19
ORsunjreMatch1.3.1_20
ORsunjreMatch1.3.1_21
ORsunjreMatch1.3.1_22
ORsunjreMatch1.3.1_23
ORsunjreMatch1.3.1_24
ORsunjreMatch1.3.1_25
ORsunsdkMatch1.3.1_01
ORsunsdkMatch1.3.1_01a
ORsunsdkMatch1.3.1_2
ORsunsdkMatch1.3.1_02
ORsunsdkMatch1.3.1_03
ORsunsdkMatch1.3.1_3
ORsunsdkMatch1.3.1_4
ORsunsdkMatch1.3.1_04
ORsunsdkMatch1.3.1_5
ORsunsdkMatch1.3.1_05
ORsunsdkMatch1.3.1_6
ORsunsdkMatch1.3.1_06
ORsunsdkMatch1.3.1_7
ORsunsdkMatch1.3.1_07
ORsunsdkMatch1.3.1_8
ORsunsdkMatch1.3.1_08
ORsunsdkMatch1.3.1_9
ORsunsdkMatch1.3.1_09
ORsunsdkMatch1.3.1_10
ORsunsdkMatch1.3.1_11
ORsunsdkMatch1.3.1_12
ORsunsdkMatch1.3.1_13
ORsunsdkMatch1.3.1_14
ORsunsdkMatch1.3.1_15
ORsunsdkMatch1.3.1_16
ORsunsdkMatch1.3.1_17
ORsunsdkMatch1.3.1_18
ORsunsdkMatch1.3.1_19
ORsunsdkMatch1.3.1_20
ORsunsdkMatch1.3.1_21
ORsunsdkMatch1.3.1_22
ORsunsdkMatch1.3.1_23
ORsunsdkMatch1.3.1_24
ORsunsdkMatch1.3.1_25
microsoftwindows
Node
sunjava_sebusiness
sunjdkMatch1.5.0update_1
ORsunjdkMatch1.5.0update_10
ORsunjdkMatch1.5.0update_11
ORsunjdkMatch1.5.0update_12
ORsunjdkMatch1.5.0update_13
ORsunjdkMatch1.5.0update_14
ORsunjdkMatch1.5.0update_15
ORsunjdkMatch1.5.0update_16
ORsunjdkMatch1.5.0update_17
ORsunjdkMatch1.5.0update_18
ORsunjdkMatch1.5.0update_19
ORsunjdkMatch1.5.0update_2
ORsunjdkMatch1.5.0update_20
ORsunjdkMatch1.5.0update_21
ORsunjdkMatch1.5.0update_3
ORsunjdkMatch1.5.0update_4
ORsunjdkMatch1.5.0update_5
ORsunjdkMatch1.5.0update_6
ORsunjdkMatch1.5.0update_7
ORsunjdkMatch1.5.0update_8
ORsunjdkMatch1.5.0update_9
ORsunjdkMatch1.6.0update_1
ORsunjdkMatch1.6.0update_10
ORsunjdkMatch1.6.0update_11
ORsunjdkMatch1.6.0update_12
ORsunjdkMatch1.6.0update_13
ORsunjdkMatch1.6.0update_14
ORsunjdkMatch1.6.0update_15
ORsunjdkMatch1.6.0update_16
ORsunjdkMatch1.6.0update_3
ORsunjdkMatch1.6.0update_4
ORsunjdkMatch1.6.0update_5
ORsunjdkMatch1.6.0update_6
ORsunjdkMatch1.6.0update_7
ORsunjdkMatch1.6.0update_8
ORsunjdkMatch1.6.0update_9
ORsunjdkMatch1.6.0update2
ORsunjreMatch1.4.2_01
ORsunjreMatch1.4.2_1
ORsunjreMatch1.4.2_2
ORsunjreMatch1.4.2_02
ORsunjreMatch1.4.2_03
ORsunjreMatch1.4.2_3
ORsunjreMatch1.4.2_4
ORsunjreMatch1.4.2_04
ORsunjreMatch1.4.2_05
ORsunjreMatch1.4.2_5
ORsunjreMatch1.4.2_06
ORsunjreMatch1.4.2_6
ORsunjreMatch1.4.2_7
ORsunjreMatch1.4.2_07
ORsunjreMatch1.4.2_8
ORsunjreMatch1.4.2_08
ORsunjreMatch1.4.2_09
ORsunjreMatch1.4.2_9
ORsunjreMatch1.4.2_10
ORsunjreMatch1.4.2_11
ORsunjreMatch1.4.2_12
ORsunjreMatch1.4.2_13
ORsunjreMatch1.4.2_14
ORsunjreMatch1.4.2_15
ORsunjreMatch1.4.2_16
ORsunjreMatch1.4.2_17
ORsunjreMatch1.4.2_18
ORsunjreMatch1.4.2_19
ORsunjreMatch1.4.2_20
ORsunjreMatch1.4.2_21
ORsunjreMatch1.4.2_22
ORsunjreMatch1.5.0update_1
ORsunjreMatch1.5.0update_11
ORsunjreMatch1.5.0update_12
ORsunjreMatch1.5.0update_13
ORsunjreMatch1.5.0update_14
ORsunjreMatch1.5.0update_15
ORsunjreMatch1.5.0update_16
ORsunjreMatch1.5.0update_17
ORsunjreMatch1.5.0update_18
ORsunjreMatch1.5.0update_19
ORsunjreMatch1.5.0update_2
ORsunjreMatch1.5.0update_20
ORsunjreMatch1.5.0update_21
ORsunjreMatch1.5.0update_3
ORsunjreMatch1.5.0update_4
ORsunjreMatch1.5.0update_5
ORsunjreMatch1.5.0update_6
ORsunjreMatch1.5.0update_7
ORsunjreMatch1.5.0update_8
ORsunjreMatch1.5.0update_9
ORsunjreMatch1.6.0update_1
ORsunjreMatch1.6.0update_10
ORsunjreMatch1.6.0update_11
ORsunjreMatch1.6.0update_12
ORsunjreMatch1.6.0update_13
ORsunjreMatch1.6.0update_14
ORsunjreMatch1.6.0update_15
ORsunjreMatch1.6.0update_16
ORsunjreMatch1.6.0update_2
ORsunjreMatch1.6.0update_3
ORsunjreMatch1.6.0update_4
ORsunjreMatch1.6.0update_5
ORsunjreMatch1.6.0update_6
ORsunjreMatch1.6.0update_7
ORsunjreMatch1.6.0update_8
ORsunjreMatch1.6.0update_9
ORsunsdkMatch1.4.2_1
ORsunsdkMatch1.4.2_2
ORsunsdkMatch1.4.2_02
ORsunsdkMatch1.4.2_03
ORsunsdkMatch1.4.2_3
ORsunsdkMatch1.4.2_04
ORsunsdkMatch1.4.2_4
ORsunsdkMatch1.4.2_5
ORsunsdkMatch1.4.2_05
ORsunsdkMatch1.4.2_6
ORsunsdkMatch1.4.2_06
ORsunsdkMatch1.4.2_07
ORsunsdkMatch1.4.2_7
ORsunsdkMatch1.4.2_8
ORsunsdkMatch1.4.2_08
ORsunsdkMatch1.4.2_09
ORsunsdkMatch1.4.2_9
ORsunsdkMatch1.4.2_10
ORsunsdkMatch1.4.2_11
ORsunsdkMatch1.4.2_12
ORsunsdkMatch1.4.2_13
ORsunsdkMatch1.4.2_14
ORsunsdkMatch1.4.2_15
ORsunsdkMatch1.4.2_16
ORsunsdkMatch1.4.2_17
ORsunsdkMatch1.4.2_18
ORsunsdkMatch1.4.2_19
ORsunsdkMatch1.4.2_20
ORsunsdkMatch1.4.2_21
ORsunsdkMatch1.4.2_22
| Vendor | Product | Version | CPE |
|---|---|---|---|
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_1:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_10:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_11:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_12:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_13:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_14:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_15:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_16:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_17:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_18:*:*:*:*:*:* |
References
java.sun.com/javase/6/webnotes/6u17.html
lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
marc.info/?l=bugtraq&m=126566824131534&w=2
marc.info/?l=bugtraq&m=131593453929393&w=2
marc.info/?l=bugtraq&m=134254866602253&w=2
secunia.com/advisories/37231
secunia.com/advisories/37239
secunia.com/advisories/37386
secunia.com/advisories/37581
secunia.com/advisories/37841
security.gentoo.org/glsa/glsa-200911-02.xml
securitytracker.com/id?1023132
sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1
support.apple.com/kb/HT3969
support.apple.com/kb/HT3970
www.mandriva.com/security/advisories?name=MDVSA-2010:084
www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
www.redhat.com/support/errata/RHSA-2009-1694.html
www.securityfocus.com/bid/36881
www.vupen.com/english/advisories/2009/3131
zerodayinitiative.com/advisories/ZDI-09-080/
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11566
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12057
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7442
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8603
Related
ubuntucve
ubuntucve
CVE-2009-3874
2009-11-05 00:00:00
prion
prion
Integer overflow
2009-11-05 16:30:00
Code injection
2010-01-13 01:30:00
zdi
zdi
Sun Java Runtime Environment JPEGImageReader Heap Overflow Vulnerability
2009-11-04 00:00:00
nvd
nvd
CVE-2009-3874
2009-11-05 16:30:00
CVE-2010-0079
2010-01-13 01:30:01
cvelist
cvelist
CVE-2009-3874
2009-11-05 16:00:00
CVE-2010-0079
2010-01-13 01:00:00
veracode
veracode
Privilege Escalation
2020-04-10 00:40:38
nessus
nessus
SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 6757)
2010-01-12 00:00:00
SuSE9 Security Update : IBM Java2 JRE and SDK (YOU Patch Number 12565)
2010-01-12 00:00:00
SuSE 11 Security Update : IBM Java 1.4.2 (SAT Patch Number 1744)
2010-01-12 00:00:00
suse
suse
remote code execution in java-1_4_2-ibm
2010-01-12 17:42:00
remote code execution in java-1_5_0-ibm
2010-01-12 09:21:12
remote code execution in java-1_6_0-ibm
2010-01-12 17:47:21
redhat
redhat
(RHSA-2010:0408) Moderate: java-1.4.2-ibm security update
2010-05-12 00:00:00
(RHSA-2009:1647) Critical: java-1.5.0-ibm security update
2009-12-08 00:00:00
(RHSA-2009:1643) Critical: java-1.4.2-ibm security update
2009-12-07 00:00:00
openvas
openvas
Sun Java JDK/JRE Multiple Vulnerabilities - Nov09 (Windows)
2009-11-13 00:00:00
RedHat Security Advisory RHSA-2009:1647
2009-12-14 00:00:00
Sun Java JDK/JRE Multiple Vulnerabilities (Nov 2009) - Windows
2009-11-13 00:00:00
securityvulns
securityvulns
HP Network Node Manager i DoS
2011-09-20 00:00:00
Sun Java multiple security vulnerabilities
2009-11-05 00:00:00
cve
cve
CVE-2010-0079
2010-01-13 01:30:01
packetstorm
packetstorm
Netragard Security Advisory 2009-12-19
2009-12-30 00:00:00
fedora
fedora
[SECURITY] Fedora 10 Update: java-1.6.0-openjdk-1.6.0.0-23.b16.fc10
2009-11-14 03:33:25
[SECURITY] Fedora 11 Update: java-1.6.0-openjdk-1.6.0.0-30.b16.fc11
2009-11-14 03:30:20
[SECURITY] Fedora 12 Update: java-1.6.0-openjdk-1.6.0.0-33.b16.fc12
2009-11-14 03:32:17
oraclelinux
oraclelinux
java-1.6.0-openjdk security update
2009-11-16 00:00:00
centos
centos
java security update
2009-11-18 10:19:02
ubuntu
ubuntu
OpenJDK vulnerabilities
2009-11-12 00:00:00
oracle
oracle
Security | Oracle Critical Patch Update - January 2010
2010-01-12 00:00:00
vmware
vmware
VMware vCenter update release addresses multiple security issues in Java JRE
2010-01-29 00:00:00
VMware vCenter update release addresses multiple security issues in Java JRE
2010-01-29 00:00:00
gentoo
gentoo
Sun JDK/JRE: Multiple vulnerabilities
2009-11-17 00:00:00
CVSS2
9.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
AI Score
7.8
Confidence
Low
EPSS
0.314
Percentile
97.0%
Related for CVE-2009-3874