PT-2009-3397 · Pulseaudio+1 · Pulse-Java+1

Marc Schoenefeld · Published 2009-04-13 · Updated 2023-02-13 · CVE-2009-0794

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Pulse-Java versions prior to the fixed version OpenJDK version 1.6.0.0

Description The issue is related to an integer overflow in the PulseAudioTargetDataL class. This allows remote attackers to cause a denial of service, resulting in an applet crash, by providing a crafted Pulse Audio source data line.

Recommendations For Pulse-Java, update to a version that includes the fix for the integer overflow in the PulseAudioTargetDataL class. For OpenJDK version 1.6.0.0, consider applying a patch or configuration change to mitigate the risk of denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability in other affected products.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-0794

Affected Products

Openjdk

Pulse-Java

References · 11

• http://secunia.com/advisories/34623 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-April/msg00203.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0794 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:162 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-April/msg00204.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=492367 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50383 · Note
• http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2009-February/004729.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0794 · Note
• http://vupen.com/english/advisories/2009/0965 · Note