PT-2009-5070 · Sun+3 · Sun Java Runtime Environment+3

Publicado 2009-08-05 · Atualizado 2018-10-10 · CVE-2009-2675

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 19 Sun Java Runtime Environment (JRE) versions 6 through 6 Update 14

Description The issue is related to an integer overflow in the unpack200 utility, allowing context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file. This leads to a heap-based buffer overflow during decompression.

Recommendations For versions 5.0 through 5.0 Update 19, update to version 5.0 Update 20 or later. For versions 6 through 6 Update 14, update to version 6 Update 15 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-2675

HPSBUX02476

RHSA-2009:1199

RHSA-2009:1200

RHSA-2009:1201

RHSA-2009:1236

RHSA-2009:1582

RHSA-2009:1662

RHSA-2009_1201

RHSA-2010:0043

Produtos afetados

Hp-Ux

Java Platform

Red Hat

Sun Java Runtime Environment

Referências · 66

• https://access.redhat.com/security/cve/CVE-2009-2672 · Nota
• http://us-cert.gov/cas/techalerts/TA09-294A.html · Nota
• https://bdu.fstec.ru/vul/2015-02870 · Nota de Segurança
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=814 · Nota
• http://secunia.com/advisories/37386 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2675 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52307 · Nota
• http://vupen.com/english/advisories/2009/3316 · Aviso do Fabricante
• http://secunia.com/advisories/36248 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-04032 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2673 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2009-2690 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 · Aviso do Fabricante
• http://xforce.iss.net/xforce/xfdb/52307 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0217 · Nota de Segurança