PT-2009-6089 · Oracle · Java Runtime Environment+1

Published 2009-11-05 · Updated 2018-10-30 · CVE-2009-3864

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 21 Java Runtime Environment (JRE) versions 6.0 through 6.0 Update 16

Description The Java Update functionality in Java Runtime Environment (JRE) does not retrieve available new JRE versions when a non-English version of Windows is used. This allows remote attackers to leverage vulnerabilities in older releases of this software.

Recommendations For Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 21, update to version 5.0 Update 22 or later. For Java Runtime Environment (JRE) versions 6.0 through 6.0 Update 16, update to version 6.0 Update 17 or later.

Fix

Related Identifiers

CVE-2009-3864

Affected Products

Java Platform

Java Runtime Environment

References · 11

• http://securityfocus.com/bid/36881 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-3864 · Security Note
• http://vupen.com/english/advisories/2009/3131 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-269868-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html · Vendor Advisory
• http://secunia.com/advisories/37231 · Vendor Advisory
• https://oracle.com/technetwork/java/javase/6u17-141447.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6753 · Note
• http://secunia.com/advisories/37239 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3864 · Note
• http://java.sun.com/javase/6/webnotes/6u17.html · Note