CVE-2009-1095

Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
VendorProductVersion
sunjdk
𝑥
≤ 1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjdk
1.5.0
sunjre
𝑥
≤ 1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjre
1.5.0
sunjdk
𝑥
≤ 1.6.0
sunjdk
1.6.0
sunjdk
1.6.0
sunjdk
1.6.0
sunjdk
1.6.0
sunjdk
1.6.0
sunjdk
1.6.0
sunjdk
1.6.0
sunjdk
1.6.0
sunjdk
1.6.0
sunjdk
1.6.0
sunjdk
1.6.0
sunjre
𝑥
≤ 1.6.0
sunjre
1.6.0
sunjre
1.6.0
sunjre
1.6.0
sunjre
1.6.0
sunjre
1.6.0
sunjre
1.6.0
sunjre
1.6.0
sunjre
1.6.0
sunjre
1.6.0
sunjre
1.6.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openjdk-6
maverick
not-affected
lucid
not-affected
karmic
not-affected
jaunty
not-affected
intrepid
Fixed 6b12-0ubuntu6.4
released
hardy
Fixed 6b18-1.8.2-4ubuntu1~8.04.1
released
gutsy
dne
dapper
dne
sun-java5
maverick
dne
lucid
dne
karmic
dne
jaunty
not-affected
intrepid
ignored
hardy
not-affected
gutsy
ignored
dapper
ignored
sun-java6
maverick
not-affected
lucid
Fixed 6.20dlj-1ubuntu3
released
karmic
Fixed 6.20dlj-0ubuntu1.9.10
released
jaunty
Fixed 6.20dlj-0ubuntu1.9.04
released
intrepid
ignored
hardy
Fixed 6.20dlj-0ubuntu1.8.04
released
gutsy
ignored
dapper
dne
Common Weakness Enumeration
References
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=781
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
http://marc.info/?l=bugtraq&m=124344236532162&w=2
http://secunia.com/advisories/34489
http://secunia.com/advisories/34495
http://secunia.com/advisories/34496
http://secunia.com/advisories/34632
http://secunia.com/advisories/34675
http://secunia.com/advisories/35156
http://secunia.com/advisories/35223
http://secunia.com/advisories/35255
http://secunia.com/advisories/35416
http://secunia.com/advisories/35776
http://secunia.com/advisories/36185
http://secunia.com/advisories/37386
http://secunia.com/advisories/37460
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-254570-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020225.1-1
http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm
http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm
http://www.debian.org/security/2009/dsa-1769
http://www.mandriva.com/security/advisories?name=MDVSA-2009:137
http://www.mandriva.com/security/advisories?name=MDVSA-2009:162
http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
http://www.redhat.com/support/errata/RHSA-2009-0392.html
http://www.redhat.com/support/errata/RHSA-2009-0394.html
http://www.redhat.com/support/errata/RHSA-2009-1038.html
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/bid/34240
http://www.securitytracker.com/id?1021894
http://www.ubuntu.com/usn/usn-748-1
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/1426
http://www.vupen.com/english/advisories/2009/3316
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10124
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6643
https://rhn.redhat.com/errata/RHSA-2009-0377.html
https://rhn.redhat.com/errata/RHSA-2009-1198.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=781
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
http://marc.info/?l=bugtraq&m=124344236532162&w=2
http://secunia.com/advisories/34489
http://secunia.com/advisories/34495
http://secunia.com/advisories/34496
http://secunia.com/advisories/34632
http://secunia.com/advisories/34675
http://secunia.com/advisories/35156
http://secunia.com/advisories/35223
http://secunia.com/advisories/35255
http://secunia.com/advisories/35416
http://secunia.com/advisories/35776
http://secunia.com/advisories/36185
http://secunia.com/advisories/37386
http://secunia.com/advisories/37460
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-254570-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020225.1-1
http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm
http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm
http://www.debian.org/security/2009/dsa-1769
http://www.mandriva.com/security/advisories?name=MDVSA-2009:137
http://www.mandriva.com/security/advisories?name=MDVSA-2009:162
http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
http://www.redhat.com/support/errata/RHSA-2009-0392.html
http://www.redhat.com/support/errata/RHSA-2009-0394.html
http://www.redhat.com/support/errata/RHSA-2009-1038.html
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/bid/34240
http://www.securitytracker.com/id?1021894
http://www.ubuntu.com/usn/usn-748-1
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/1426
http://www.vupen.com/english/advisories/2009/3316
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10124
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6643
https://rhn.redhat.com/errata/RHSA-2009-0377.html
https://rhn.redhat.com/errata/RHSA-2009-1198.html