CVE-2009-1097

{"id": "CVE-2009-1097", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2009-03-25T23:30:00.297", "references": [{"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133", "source": "cve@mitre.org"}, {"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=779", "source": "cve@mitre.org"}, {"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=780", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=124344236532162&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/34489", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/34496", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/34632", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/34675", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/35156", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/35223", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/35255", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/35776", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/36185", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/37386", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/37460", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://security.gentoo.org/glsa/glsa-200911-02.xml", "source": "cve@mitre.org"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-254571-1", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm", "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2009/dsa-1769", "source": "cve@mitre.org"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:137", "source": "cve@mitre.org"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:162", "source": "cve@mitre.org"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2009-0392.html", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2009-1038.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/34240", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1021913", "source": "cve@mitre.org"}, {"url": "http://www.ubuntu.com/usn/usn-748-1", "source": "cve@mitre.org"}, {"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2009/1426", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2009/3316", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49475", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11241", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6288", "source": "cve@mitre.org"}, {"url": "https://rhn.redhat.com/errata/RHSA-2009-0377.html", "source": "cve@mitre.org"}, {"url": "https://rhn.redhat.com/errata/RHSA-2009-1198.html", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "Multiple buffer overflows in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allow remote attackers to access files or execute arbitrary code via (1) a crafted PNG image that triggers an integer overflow during memory allocation for display on the splash screen, aka CR 6804996; and (2) a crafted GIF image from which unspecified values are used in calculation of offsets, leading to object-pointer corruption, aka CR 6804997."}, {"lang": "es", "value": "M\u00faltiples desbordamientos de b\u00fafer en Java SE Development Kit (JDK) y Java Runtime Environment (JRE) versi\u00f3n 6 Update 12 y anteriores, permiten a los atacantes remotos acceder a archivos o ejecutar c\u00f3digo arbitrario por medio de (1) una imagen PNG dise\u00f1ada que desencadena un desbordamiento de enteros durante la asignaci\u00f3n de memoria para su visualizaci\u00f3n en la pantalla de presentaci\u00f3n, tambi\u00e9n se conoce como CR 6804996; y (2) una imagen GIF dise\u00f1ada a partir de la cual se utilizan valores no especificados en el c\u00e1lculo de desplazamientos, conllevando a una corrupci\u00f3n de puntero de objeto, tambi\u00e9n se conoce como CR 6804997."}], "lastModified": "2018-10-10T19:33:35.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sun:jdk:*:update_12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C826CA0-A25F-4A10-BD9E-791372BF8F06", "versionEndIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3A4FEC7-A4A0-4B5C-A56C-8F80AE19865E"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "722A93D8-B5BC-42F3-92A2-E424F61269A8"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "775F2611-F11C-4B84-8F40-0D034B81BF18"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D98175BF-B084-4FA5-899D-9E80DC3923EE"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "820632CE-F8DF-47EE-B716-7530E60008B7"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA2BD0A3-7B2D-447B-ABAC-7B867B03B632"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D54AB785-E9B7-47BD-B756-0C3A629D67DD"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9412098-0353-4F7B-9245-010557E6C651"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD30DAEB-4893-41CF-A455-B69C463B9337"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21D6CE7E-A036-496C-8E08-A87F62B5290A"}, {"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8F93BBE-1E8C-4EB3-BCC7-20AB2D813F98"}, {"criteria": "cpe:2.3:a:sun:jre:*:update_12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F38BA27-0EBC-47EC-99BF-A018E0BB0D53", "versionEndIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBCD143C-057D-4F42-B487-46801E14ACF7"}, {"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09027C19-D442-446F-B7A8-21DB6787CF43"}, {"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A0FEC28-0707-4F42-9740-78F3D2D551EE"}, {"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3C5879A-A608-4230-9DC1-C27F0F48A13B"}, {"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7158D2C0-E9AC-4CD6-B777-EA7B7A181997"}, {"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90EC6C13-4B37-48E5-8199-A702A944D5A6"}, {"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2528152C-E20A-4D97-931C-A5EC3CEAA06D"}, {"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A99DAB4C-272B-4C91-BC70-7729E1152590"}, {"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30DFC10A-A4D9-4F89-B17C-AB9260087D29"}, {"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "272A5C44-18EC-41A9-8233-E9D4D0734EA6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}