Sun Java SE vulnerabilities

14 CVEs affecting Sun Java SE, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2009-2724, published 2009-08-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-2676, published 2009-08-05. Medium severity, CVSS 6.8. EPSS: 3.6% chance of exploitation in the next 30 days. Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK…
CVE-2009-2476, published 2009-08-10. High severity, CVSS 10.0. EPSS: 2.9% chance of exploitation in the next 30 days. The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass…
CVE-2009-2689, published 2009-08-10. High severity, CVSS 10.0. EPSS: 2.8% chance of exploitation in the next 30 days. JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent…
CVE-2009-2722, published 2009-08-10. High severity, CVSS 10.0. EPSS: 2.8% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429594. NOTE: this issue exists because of an…
CVE-2009-2723, published 2009-08-10. High severity, CVSS 10.0. EPSS: 2.7% chance of exploitation in the next 30 days. Unspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka BugId 6444262.
CVE-2009-2690, published 2009-08-10. Medium severity, CVSS 5.0. EPSS: 2.6% chance of exploitation in the next 30 days. The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information…
CVE-2009-2721, published 2009-08-10. High severity, CVSS 10.0. EPSS: 2.4% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406003.
CVE-2009-2475, published 2009-08-10. High severity, CVSS 7.8. EPSS: 2.3% chance of exploitation in the next 30 days. Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared…
CVE-2009-2719, published 2009-08-10. Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days. The Java Web Start implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException) via a crafted .jnlp file, as demonstrated by…
CVE-2009-2720, published 2009-08-10. Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days. Unspecified vulnerability in the javax.swing.plaf.synth.SynthContext.isSubregion method in the Swing implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a…

Latest

CVE-2009-2724, published 2009-08-10. High severity, CVSS 9.3. EPSS: 1.6% chance of exploitation in the next 30 days. Race condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in reflection checks."
CVE-2009-2718, published 2009-08-10. Medium severity, CVSS 6.8. EPSS: 1.7% chance of exploitation in the next 30 days. The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on X11 does not impose the intended constraint on distance from the window border to the Security Warning Icon,…
CVE-2009-2717, published 2009-08-10. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on Windows 2000 Professional does not provide a Security Warning Icon, which makes it easier for context-dependent…
CVE-2009-2716, published 2009-08-10. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. The plugin functionality in Sun Java SE 6 before Update 15 does not properly implement version selection, which allows context-dependent attackers to leverage vulnerabilities in "old zip and…