PT-2009-3675 · Oracle+2 · Java Se Development Kit+4

Published 2009-03-25 · Updated 2018-10-10 · CVE-2009-1097

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 12 and earlier

Description The issue allows remote attackers to access files or execute arbitrary code via crafted images. Specifically, it can be triggered by a crafted PNG image that causes an integer overflow during memory allocation for display on the splash screen. Additionally, a crafted GIF image can lead to object-pointer corruption due to unspecified values used in offset calculations.

Recommendations For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 12 and earlier, update to a version later than 6 Update 12 to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-1097

DSA-1769-1

HPSBUX02429

RHSA-2009:0377

RHSA-2009:0392

RHSA-2009:1038

RHSA-2009:1198

RHSA-2009_0377

RHSA-2010:0043

Affected Products

Hp-Ux

Java Platform

Java Runtime Environment

Java Se Development Kit

Red Hat

References · 83

• https://rhn.redhat.com/errata/RHSA-2009-1198.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1101 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-0377.html · Vendor Advisory
• http://secunia.com/advisories/35255 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06299 · Security Note
• https://bdu.fstec.ru/vul/2015-03027 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1426 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1103 · Security Note
• https://bdu.fstec.ru/vul/2015-03026 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:137 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:162 · Vendor Advisory
• http://secunia.com/advisories/35223 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1107 · Security Note