PT-2009-5070 · Sun+3 · Sun Java Runtime Environment+3

Published 2009-08-05 · Updated 2018-10-10 · CVE-2009-2675

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 19 Sun Java Runtime Environment (JRE) versions 6 through 6 Update 14

Description The issue is related to an integer overflow in the unpack200 utility, allowing context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file. This leads to a heap-based buffer overflow during decompression.

Recommendations For versions 5.0 through 5.0 Update 19, update to version 5.0 Update 20 or later. For versions 6 through 6 Update 14, update to version 6 Update 15 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-2675

HPSBUX02476

RHSA-2009:1199

RHSA-2009:1200

RHSA-2009:1201

RHSA-2009:1236

RHSA-2009:1582

RHSA-2009:1662

RHSA-2009_1201

RHSA-2010:0043

Affected Products

Hp-Ux

Java Platform

Red Hat

Sun Java Runtime Environment

References · 66

• https://bdu.fstec.ru/vul/2015-02870 · Security Note
• http://secunia.com/advisories/37386 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2675 · Security Note
• http://vupen.com/english/advisories/2009/3316 · Vendor Advisory
• http://secunia.com/advisories/36248 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04032 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2673 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0217 · Security Note
• http://secunia.com/advisories/37460 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-1201.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html · Vendor Advisory
• http://secunia.com/advisories/36199 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04033 · Security Note