Sun Openjdk vulnerabilities

16 CVEs affecting Sun Openjdk, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2009-3884, published 2009-11-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-0733, published 2009-03-23. High severity, CVSS 9.3. EPSS: 5.5% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent…
CVE-2009-0723, published 2009-03-23. High severity, CVSS 9.3. EPSS: 5% chance of exploitation in the next 30 days. Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a…
CVE-2009-0793, published 2009-04-09. Medium severity, CVSS 4.3. EPSS: 4.8% chance of exploitation in the next 30 days. cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a…
CVE-2009-3728, published 2009-11-09. Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days. Directory traversal vulnerability in the ICC_Profile.getInstance method in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote…
CVE-2009-1896, published 2009-08-10. High severity, CVSS 10.0. EPSS: 3% chance of exploitation in the next 30 days. The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed…
CVE-2009-0794, published 2009-04-13. Medium severity, CVSS 5.0. EPSS: 3% chance of exploitation in the next 30 days. Integer overflow in the PulseAudioTargetDataL class in src/java/org/classpath/icedtea/pulseaudio/PulseAudioTargetDataLine.java in Pulse-Java, as used in OpenJDK 1.6.0.0 and other products, allows…
CVE-2009-3884, published 2009-11-09. Medium severity, CVSS 5.0. EPSS: 3% chance of exploitation in the next 30 days. The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local files via vectors related to…
CVE-2009-2476, published 2009-08-10. High severity, CVSS 10.0. EPSS: 2.9% chance of exploitation in the next 30 days. The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass…
CVE-2009-2689, published 2009-08-10. High severity, CVSS 10.0. EPSS: 2.8% chance of exploitation in the next 30 days. JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent…
CVE-2009-3881, published 2009-11-09. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via…

Latest

CVE-2009-3883, published 2009-11-09. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the Windows Pluggable Look and Feel (PL&F) feature in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have…
CVE-2009-3882, published 2009-11-09. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to…
CVE-2009-3880, published 2009-11-09. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to…
CVE-2009-3879, published 2009-11-09. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the (1) X11 and (2) Win32GraphicsDevice subsystems in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and attack…
CVE-2009-2690, published 2009-08-10. Medium severity, CVSS 5.0. EPSS: 2.6% chance of exploitation in the next 30 days. The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information…