CVE-2009-2475

2009-08-1000:00:00

ubuntu.com

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

0.006 Low

EPSS

Percentile

79.0%

JSON

Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might
allow context-dependent attackers to obtain sensitive information via
vectors involving static variables that are declared without the final
keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3)
AccessibleResourceBundle.getContents, (4)
ImageReaderSpi.STANDARD_INPUT_TYPE, (5)
ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7)
DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9)
AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap,
(11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a
different vulnerability than CVE-2009-2673.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=513215>

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchopenjdk-6< 6b18-1.8.2-4ubuntu1~8.04.1UNKNOWN
ubuntu8.10noarchopenjdk-6< 6b12-0ubuntu6.5UNKNOWN
ubuntu9.04noarchopenjdk-6< 6b14-1.4.1-0ubuntu11UNKNOWN
ubuntu8.04noarchsun-java6< 6.20dlj-0ubuntu1.8.04UNKNOWN
ubuntu9.04noarchsun-java6< 6.20dlj-0ubuntu1.9.04UNKNOWN
ubuntu9.10noarchsun-java6< 6-15-1UNKNOWN
ubuntu10.04noarchsun-java6< 6-15-1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	openjdk-6	< 6b18-1.8.2-4ubuntu1~8.04.1	UNKNOWN
ubuntu	8.10	noarch	openjdk-6	< 6b12-0ubuntu6.5	UNKNOWN
ubuntu	9.04	noarch	openjdk-6	< 6b14-1.4.1-0ubuntu11	UNKNOWN
ubuntu	8.04	noarch	sun-java6	< 6.20dlj-0ubuntu1.8.04	UNKNOWN
ubuntu	9.04	noarch	sun-java6	< 6.20dlj-0ubuntu1.9.04	UNKNOWN
ubuntu	9.10	noarch	sun-java6	< 6-15-1	UNKNOWN
ubuntu	10.04	noarch	sun-java6	< 6-15-1	UNKNOWN