1. CVE-Search
  2. CVE-2009-1100
ID CVE-2009-1100
Summary Multiple unspecified vulnerabilities in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allow remote attackers to cause a denial of service (disk consumption) via vectors related to temporary font files and (1) "limits on Font creation," aka CR 6522586, and (2) another unspecified vector, aka CR 6632886.
References
Vulnerable Configurations
  • cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update11_b03:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update11_b03:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update7_b03:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update7_b03:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.3.1:update17:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.3.1:update17:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 10-10-2018 - 19:33)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
oval via4
accepted 2014-01-20T04:01:25.000-05:00
class vulnerability
contributors
  • name Michael Wood
    organization Hewlett-Packard
  • name Chris Coffin
    organization The MITRE Corporation
definition_extensions
  • comment VMware ESX Server 3.5.0 is installed
    oval oval:org.mitre.oval:def:5887
  • comment VMware ESX Server 4.0 is installed
    oval oval:org.mitre.oval:def:6293
description Multiple unspecified vulnerabilities in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allow remote attackers to cause a denial of service (disk consumption) via vectors related to temporary font files and (1) "limits on Font creation," aka CR 6522586, and (2) another unspecified vector, aka CR 6632886.
family unix
id oval:org.mitre.oval:def:6224
status accepted
submitted 2009-11-30T15:39:02.000-04:00
title Java Runtime Environment (JRE) Flaws in Storing and Processing Temporary Font Files Let Remote Users Deny Service
version 7
redhat via4
advisories
  • rhsa
    id RHSA-2009:0392
  • rhsa
    id RHSA-2009:0394
  • rhsa
    id RHSA-2009:1038
  • rhsa
    id RHSA-2009:1198
rpms
  • java-1.6.0-sun-1:1.6.0.13-1jpp.1.el4
  • java-1.6.0-sun-1:1.6.0.13-1jpp.1.el5
  • java-1.6.0-sun-demo-1:1.6.0.13-1jpp.1.el4
  • java-1.6.0-sun-demo-1:1.6.0.13-1jpp.1.el5
  • java-1.6.0-sun-devel-1:1.6.0.13-1jpp.1.el4
  • java-1.6.0-sun-devel-1:1.6.0.13-1jpp.1.el5
  • java-1.6.0-sun-jdbc-1:1.6.0.13-1jpp.1.el4
  • java-1.6.0-sun-jdbc-1:1.6.0.13-1jpp.1.el5
  • java-1.6.0-sun-plugin-1:1.6.0.13-1jpp.1.el4
  • java-1.6.0-sun-plugin-1:1.6.0.13-1jpp.1.el5
  • java-1.6.0-sun-src-1:1.6.0.13-1jpp.1.el4
  • java-1.6.0-sun-src-1:1.6.0.13-1jpp.1.el5
  • java-1.5.0-sun-0:1.5.0.18-1jpp.1.el4
  • java-1.5.0-sun-0:1.5.0.18-1jpp.1.el5
  • java-1.5.0-sun-demo-0:1.5.0.18-1jpp.1.el4
  • java-1.5.0-sun-demo-0:1.5.0.18-1jpp.1.el5
  • java-1.5.0-sun-devel-0:1.5.0.18-1jpp.1.el4
  • java-1.5.0-sun-devel-0:1.5.0.18-1jpp.1.el5
  • java-1.5.0-sun-jdbc-0:1.5.0.18-1jpp.1.el4
  • java-1.5.0-sun-jdbc-0:1.5.0.18-1jpp.1.el5
  • java-1.5.0-sun-plugin-0:1.5.0.18-1jpp.1.el4
  • java-1.5.0-sun-plugin-0:1.5.0.18-1jpp.1.el5
  • java-1.5.0-sun-src-0:1.5.0.18-1jpp.1.el4
  • java-1.5.0-sun-src-0:1.5.0.18-1jpp.1.el5
  • java-1.5.0-ibm-1:1.5.0.9-1jpp.3.el5
  • java-1.5.0-ibm-1:1.5.0.9-1jpp.5.el4
  • java-1.5.0-ibm-accessibility-1:1.5.0.9-1jpp.3.el5
  • java-1.5.0-ibm-demo-1:1.5.0.9-1jpp.3.el5
  • java-1.5.0-ibm-demo-1:1.5.0.9-1jpp.5.el4
  • java-1.5.0-ibm-devel-1:1.5.0.9-1jpp.3.el5
  • java-1.5.0-ibm-devel-1:1.5.0.9-1jpp.5.el4
  • java-1.5.0-ibm-javacomm-1:1.5.0.9-1jpp.3.el5
  • java-1.5.0-ibm-javacomm-1:1.5.0.9-1jpp.5.el4
  • java-1.5.0-ibm-jdbc-1:1.5.0.9-1jpp.3.el5
  • java-1.5.0-ibm-jdbc-1:1.5.0.9-1jpp.5.el4
  • java-1.5.0-ibm-plugin-1:1.5.0.9-1jpp.3.el5
  • java-1.5.0-ibm-plugin-1:1.5.0.9-1jpp.5.el4
  • java-1.5.0-ibm-src-1:1.5.0.9-1jpp.3.el5
  • java-1.5.0-ibm-src-1:1.5.0.9-1jpp.5.el4
  • java-1.6.0-ibm-1:1.6.0.5-1jpp.1.el4
  • java-1.6.0-ibm-1:1.6.0.5-1jpp.1.el5
  • java-1.6.0-ibm-accessibility-1:1.6.0.5-1jpp.1.el5
  • java-1.6.0-ibm-demo-1:1.6.0.5-1jpp.1.el4
  • java-1.6.0-ibm-demo-1:1.6.0.5-1jpp.1.el5
  • java-1.6.0-ibm-devel-1:1.6.0.5-1jpp.1.el4
  • java-1.6.0-ibm-devel-1:1.6.0.5-1jpp.1.el5
  • java-1.6.0-ibm-javacomm-1:1.6.0.5-1jpp.1.el4
  • java-1.6.0-ibm-javacomm-1:1.6.0.5-1jpp.1.el5
  • java-1.6.0-ibm-jdbc-1:1.6.0.5-1jpp.1.el4
  • java-1.6.0-ibm-jdbc-1:1.6.0.5-1jpp.1.el5
  • java-1.6.0-ibm-plugin-1:1.6.0.5-1jpp.1.el4
  • java-1.6.0-ibm-plugin-1:1.6.0.5-1jpp.1.el5
  • java-1.6.0-ibm-src-1:1.6.0.5-1jpp.1.el4
  • java-1.6.0-ibm-src-1:1.6.0.5-1jpp.1.el5
  • java-1.4.2-ibm-0:1.4.2.13.2.sap-1jpp.4.el4_8
  • java-1.4.2-ibm-0:1.4.2.13.2.sap-1jpp.4.el5_3
  • java-1.4.2-ibm-demo-0:1.4.2.13.2.sap-1jpp.4.el4_8
  • java-1.4.2-ibm-demo-0:1.4.2.13.2.sap-1jpp.4.el5_3
  • java-1.4.2-ibm-devel-0:1.4.2.13.2.sap-1jpp.4.el4_8
  • java-1.4.2-ibm-devel-0:1.4.2.13.2.sap-1jpp.4.el5_3
  • java-1.4.2-ibm-javacomm-0:1.4.2.13.2.sap-1jpp.4.el4_8
  • java-1.4.2-ibm-javacomm-0:1.4.2.13.2.sap-1jpp.4.el5_3
  • java-1.4.2-ibm-src-0:1.4.2.13.2.sap-1jpp.4.el4_8
  • java-1.4.2-ibm-src-0:1.4.2.13.2.sap-1jpp.4.el5_3
  • java-1.5.0-sun-0:1.5.0.22-1jpp.1.el4
  • java-1.5.0-sun-devel-0:1.5.0.22-1jpp.1.el4
  • java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4
  • java-1.6.0-ibm-devel-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-devel-1:1.6.0.7-1jpp.3.el4
refmap via4
bid 34240
bugtraq 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components
confirm
gentoo GLSA-200911-02
hp
  • HPSBMA02429
  • HPSBUX02429
  • SSRT090058
misc http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-19-1
sectrack 1021917
secunia
  • 34489
  • 34495
  • 34496
  • 35156
  • 35223
  • 35255
  • 35416
  • 35776
  • 36185
  • 37386
  • 37460
sunalert 254608
suse
  • SUSE-SA:2009:016
  • SUSE-SA:2009:029
  • SUSE-SA:2009:036
  • SUSE-SR:2009:011
ubuntu USN-748-1
vupen
  • ADV-2009-1426
  • ADV-2009-3316
Last major update 10-10-2018 - 19:33
Published 25-03-2009 - 23:30
Last modified 10-10-2018 - 19:33
Back to Top