PT-2009-3685 · Oracle+1 · Java Se Development Kit+2

Published 2009-03-25 · Updated 2018-10-10 · CVE-2009-1107

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 12 and earlier Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 5.0 Update 17 and earlier

Description The issue allows remote attackers to trick a user into trusting a signed applet via unknown vectors that misrepresent the security warning dialog, related to a Swing JLabel HTML parsing issue.

Recommendations For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 12 and earlier, update to a version later than Update 12. For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 5.0 Update 17 and earlier, update to a version later than Update 17.

Fix

Related Identifiers

CVE-2009-1107

HPSBUX02429

RHSA-2009:0392

RHSA-2009:0394

RHSA-2009:1038

RHSA-2009:1198

RHSA-2009:1662

RHSA-2010:0043

Affected Products

Hp-Ux

Java Runtime Environment

Java Se Development Kit

References · 48

• http://redhat.com/support/errata/RHSA-2009-1038.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1096 · Security Note
• http://marc.info/?l=bugtraq&m=124344236532162&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1098 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1101 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1102 · Security Note
• https://rhn.redhat.com/errata/RHSA-2009-1198.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-14-1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-1107 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1100 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1104 · Security Note