CVE-2009-2689

published 2009-08-10

CVE-2009-2689: JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object…

critical 10 CVSS 3.1

AV N AC L Au N C C I C A C

JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
sun	java_se	<= 5.0	—
sun	java_se	<= 6	—

CWE-264