CVE-2009-3864
published 2009-11-05CVE-2009-3864: The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a…
PriorityP350high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
22.48%
97.4th percentile
The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to leverage vulnerabilities in older releases of this software, aka Bug Id 6869694.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9f95-v5qr-4cqr: The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5
ghsa_unreviewed·2022-05-02
CVE-2009-3864 [HIGH] GHSA-9f95-v5qr-4cqr: The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5
The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to leverage vulnerabilities in older releases of this software, aka Bug Id 6869694.
Red Hat
java-1.6.0-sun: Updates availability notification system failure (6869694)
vendor_redhat·2009-11-04·CVSS 7.5
CVE-2009-3864 [HIGH] CWE-223 java-1.6.0-sun: Updates availability notification system failure (6869694)
java-1.6.0-sun: Updates availability notification system failure (6869694)
The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to leverage vulnerabilities in older releases of this software, aka Bug Id 6869694.
No detection rules found.
No public exploits indexed.
http://java.sun.com/javase/6/webnotes/6u17.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.htmlhttp://secunia.com/advisories/37231http://secunia.com/advisories/37239http://sunsolve.sun.com/search/document.do?assetkey=1-66-269868-1http://www.securityfocus.com/bid/36881http://www.vupen.com/english/advisories/2009/3131https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6753http://java.sun.com/javase/6/webnotes/6u17.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.htmlhttp://secunia.com/advisories/37231http://secunia.com/advisories/37239http://sunsolve.sun.com/search/document.do?assetkey=1-66-269868-1http://www.securityfocus.com/bid/36881http://www.vupen.com/english/advisories/2009/3131https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6753
2009-11-05
Published