CVE-2009-2475
10.08.2009, 18:30
Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.Enginsight
| Vendor | Product | Version |
|---|---|---|
| sun | java_se | 𝑥 ≤ 5.0 |
| sun | java_se | 𝑥 ≤ 6 |
| sun | openjdk | * |
𝑥
= Vulnerable software versions
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| java |
| ||||||||||||||||
| openjdk-6 |
| ||||||||||||||||
| sun-java5 |
| ||||||||||||||||
| sun-java6 |
|
Common Weakness Enumeration
References