CVE-2009-3876 — JDK vulnerability

CWE-3996 documents6 sources

Severity

5.0MEDIUMNVD

EPSS

11.0%

top 6.55%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

SUN JDK SUN JRE SUN SDK

Timeline

PublishedNov 5

Latest updateMay 2

Description

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER encoded data, which is not properly decoded by the ASN.1 DER input stream parser, aka Bug Id 6864911.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶NVDsun/jdk1.5.0, 1.6.0+1

▶NVDsun/jre68 versions+67

▶NVDsun/sdk66 versions+65

Patches

Patch: sunsolve.sun.com ↗Patch: sunsolve.sun.com ↗

🔴Vulnerability Details

GHSA

GHSA-6cmw-6629-4xwg: Unspecified vulnerability in Sun Java SE in JDK and JRE 5↗2022-05-02

▶

CVEList

CVE-2009-3876: Unspecified vulnerability in Sun Java SE in JDK and JRE 5↗2009-11-05

▶

📋Vendor Advisories

Ubuntu

OpenJDK vulnerabilities↗2009-11-12

▶

Red Hat

OpenJDK ASN.1/DER input stream parser denial of service (6864911) CVE-2009-3877↗2009-11-03

▶

💬Community

Bugzilla

CVE-2009-3876 OpenJDK ASN.1/DER input stream parser denial of service (6864911) CVE-2009-3877↗2009-10-21

▶