Lucene search
MitreCVE-2009-3867HistoryNov 05, 2009 - 4:30 p.m.
CVE-2009-3867
2009-11-0516:30:00
CWE-119
mitre
web.nvd.nist.gov
66
cve-2009-3867
stack-based buffer overflow
sun java se
remote code execution
url
cve
CVSS2
9.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
AI Score
7.7
Confidence
Low
EPSS
0.932
Percentile
99.1%
Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.
Affected configurations
Node
sunjdkMatch1.5.0update_1
ORsunjdkMatch1.5.0update_10
ORsunjdkMatch1.5.0update_11
ORsunjdkMatch1.5.0update_12
ORsunjdkMatch1.5.0update_13
ORsunjdkMatch1.5.0update_14
ORsunjdkMatch1.5.0update_15
ORsunjdkMatch1.5.0update_16
ORsunjdkMatch1.5.0update_17
ORsunjdkMatch1.5.0update_18
ORsunjdkMatch1.5.0update_19
ORsunjdkMatch1.5.0update_2
ORsunjdkMatch1.5.0update_20
ORsunjdkMatch1.5.0update_21
ORsunjdkMatch1.5.0update_3
ORsunjdkMatch1.5.0update_4
ORsunjdkMatch1.5.0update_5
ORsunjdkMatch1.5.0update_6
ORsunjdkMatch1.5.0update_7
ORsunjdkMatch1.5.0update_8
ORsunjdkMatch1.5.0update_9
ORsunjdkMatch1.6.0update_1
ORsunjdkMatch1.6.0update_10
ORsunjdkMatch1.6.0update_11
ORsunjdkMatch1.6.0update_12
ORsunjdkMatch1.6.0update_13
ORsunjdkMatch1.6.0update_14
ORsunjdkMatch1.6.0update_15
ORsunjdkMatch1.6.0update_16
ORsunjdkMatch1.6.0update_3
ORsunjdkMatch1.6.0update_4
ORsunjdkMatch1.6.0update_5
ORsunjdkMatch1.6.0update_6
ORsunjdkMatch1.6.0update_7
ORsunjdkMatch1.6.0update_8
ORsunjdkMatch1.6.0update_9
ORsunjreMatch1.5.0update_1
ORsunjreMatch1.5.0update_11
ORsunjreMatch1.5.0update_12
ORsunjreMatch1.5.0update_13
ORsunjreMatch1.5.0update_14
ORsunjreMatch1.5.0update_15
ORsunjreMatch1.5.0update_16
ORsunjreMatch1.5.0update_17
ORsunjreMatch1.5.0update_18
ORsunjreMatch1.5.0update_19
ORsunjreMatch1.5.0update_2
ORsunjreMatch1.5.0update_20
ORsunjreMatch1.5.0update_21
ORsunjreMatch1.5.0update_3
ORsunjreMatch1.5.0update_4
ORsunjreMatch1.5.0update_5
ORsunjreMatch1.5.0update_6
ORsunjreMatch1.5.0update_7
ORsunjreMatch1.5.0update_8
ORsunjreMatch1.5.0update_9
ORsunjreMatch1.6.0update_1
ORsunjreMatch1.6.0update_10
ORsunjreMatch1.6.0update_11
ORsunjreMatch1.6.0update_12
ORsunjreMatch1.6.0update_13
ORsunjreMatch1.6.0update_14
ORsunjreMatch1.6.0update_15
ORsunjreMatch1.6.0update_16
ORsunjreMatch1.6.0update_2
ORsunjreMatch1.6.0update_3
ORsunjreMatch1.6.0update_4
ORsunjreMatch1.6.0update_5
ORsunjreMatch1.6.0update_6
ORsunjreMatch1.6.0update_7
ORsunjreMatch1.6.0update_8
ORsunjreMatch1.6.0update_9
Node
sunjreMatch1.4.2_1
ORsunjreMatch1.4.2_2
ORsunjreMatch1.4.2_02
ORsunjreMatch1.4.2_03
ORsunjreMatch1.4.2_3
ORsunjreMatch1.4.2_4
ORsunjreMatch1.4.2_04
ORsunjreMatch1.4.2_05
ORsunjreMatch1.4.2_5
ORsunjreMatch1.4.2_06
ORsunjreMatch1.4.2_6
ORsunjreMatch1.4.2_7
ORsunjreMatch1.4.2_07
ORsunjreMatch1.4.2_8
ORsunjreMatch1.4.2_08
ORsunjreMatch1.4.2_09
ORsunjreMatch1.4.2_9
ORsunjreMatch1.4.2_10
ORsunjreMatch1.4.2_11
ORsunjreMatch1.4.2_12
ORsunjreMatch1.4.2_13
ORsunjreMatch1.4.2_14
ORsunjreMatch1.4.2_15
ORsunjreMatch1.4.2_16
ORsunjreMatch1.4.2_17
ORsunjreMatch1.4.2_18
ORsunjreMatch1.4.2_19
ORsunjreMatch1.4.2_20
ORsunjreMatch1.4.2_21
ORsunjreMatch1.4.2_22
ORsunsdkMatch1.4.2_01
ORsunsdkMatch1.4.2_1
ORsunsdkMatch1.4.2_2
ORsunsdkMatch1.4.2_02
ORsunsdkMatch1.4.2_03
ORsunsdkMatch1.4.2_3
ORsunsdkMatch1.4.2_04
ORsunsdkMatch1.4.2_4
ORsunsdkMatch1.4.2_5
ORsunsdkMatch1.4.2_05
ORsunsdkMatch1.4.2_6
ORsunsdkMatch1.4.2_06
ORsunsdkMatch1.4.2_07
ORsunsdkMatch1.4.2_7
ORsunsdkMatch1.4.2_8
ORsunsdkMatch1.4.2_08
ORsunsdkMatch1.4.2_09
ORsunsdkMatch1.4.2_9
ORsunsdkMatch1.4.2_10
ORsunsdkMatch1.4.2_11
ORsunsdkMatch1.4.2_12
ORsunsdkMatch1.4.2_13
ORsunsdkMatch1.4.2_14
ORsunsdkMatch1.4.2_15
ORsunsdkMatch1.4.2_16
ORsunsdkMatch1.4.2_17
ORsunsdkMatch1.4.2_18
ORsunsdkMatch1.4.2_19
ORsunsdkMatch1.4.2_20
ORsunsdkMatch1.4.2_21
ORsunsdkMatch1.4.2_22
sunsolaris
Node
sunjreMatch1.3.1_1
ORsunjreMatch1.3.1_01
ORsunjreMatch1.3.1_01a
ORsunjreMatch1.3.1_02
ORsunjreMatch1.3.1_2
ORsunjreMatch1.3.1_03
ORsunjreMatch1.3.1_3
ORsunjreMatch1.3.1_4
ORsunjreMatch1.3.1_04
ORsunjreMatch1.3.1_05
ORsunjreMatch1.3.1_5
ORsunjreMatch1.3.1_06
ORsunjreMatch1.3.1_6
ORsunjreMatch1.3.1_07
ORsunjreMatch1.3.1_7
ORsunjreMatch1.3.1_8
ORsunjreMatch1.3.1_08
ORsunjreMatch1.3.1_9
ORsunjreMatch1.3.1_09
ORsunjreMatch1.3.1_10
ORsunjreMatch1.3.1_11
ORsunjreMatch1.3.1_12
ORsunjreMatch1.3.1_13
ORsunjreMatch1.3.1_14
ORsunjreMatch1.3.1_15
ORsunjreMatch1.3.1_16
ORsunjreMatch1.3.1_17
ORsunjreMatch1.3.1_18
ORsunjreMatch1.3.1_19
ORsunjreMatch1.3.1_20
ORsunjreMatch1.3.1_21
ORsunjreMatch1.3.1_22
ORsunjreMatch1.3.1_23
ORsunjreMatch1.3.1_24
ORsunjreMatch1.3.1_25
ORsunsdkMatch1.3.1_01
ORsunsdkMatch1.3.1_01a
ORsunsdkMatch1.3.1_2
ORsunsdkMatch1.3.1_02
ORsunsdkMatch1.3.1_03
ORsunsdkMatch1.3.1_3
ORsunsdkMatch1.3.1_4
ORsunsdkMatch1.3.1_04
ORsunsdkMatch1.3.1_5
ORsunsdkMatch1.3.1_05
ORsunsdkMatch1.3.1_6
ORsunsdkMatch1.3.1_06
ORsunsdkMatch1.3.1_7
ORsunsdkMatch1.3.1_07
ORsunsdkMatch1.3.1_8
ORsunsdkMatch1.3.1_08
ORsunsdkMatch1.3.1_9
ORsunsdkMatch1.3.1_09
ORsunsdkMatch1.3.1_10
ORsunsdkMatch1.3.1_11
ORsunsdkMatch1.3.1_12
ORsunsdkMatch1.3.1_13
ORsunsdkMatch1.3.1_14
ORsunsdkMatch1.3.1_15
ORsunsdkMatch1.3.1_16
ORsunsdkMatch1.3.1_17
ORsunsdkMatch1.3.1_18
ORsunsdkMatch1.3.1_19
ORsunsdkMatch1.3.1_20
ORsunsdkMatch1.3.1_21
ORsunsdkMatch1.3.1_22
ORsunsdkMatch1.3.1_23
ORsunsdkMatch1.3.1_24
ORsunsdkMatch1.3.1_25
microsoftwindows
Node
sunjava_sebusiness
sunjdkMatch1.5.0update_1
ORsunjdkMatch1.5.0update_10
ORsunjdkMatch1.5.0update_11
ORsunjdkMatch1.5.0update_12
ORsunjdkMatch1.5.0update_13
ORsunjdkMatch1.5.0update_14
ORsunjdkMatch1.5.0update_15
ORsunjdkMatch1.5.0update_16
ORsunjdkMatch1.5.0update_17
ORsunjdkMatch1.5.0update_18
ORsunjdkMatch1.5.0update_19
ORsunjdkMatch1.5.0update_2
ORsunjdkMatch1.5.0update_20
ORsunjdkMatch1.5.0update_21
ORsunjdkMatch1.5.0update_3
ORsunjdkMatch1.5.0update_4
ORsunjdkMatch1.5.0update_5
ORsunjdkMatch1.5.0update_6
ORsunjdkMatch1.5.0update_7
ORsunjdkMatch1.5.0update_8
ORsunjdkMatch1.5.0update_9
ORsunjdkMatch1.6.0update_1
ORsunjdkMatch1.6.0update_10
ORsunjdkMatch1.6.0update_11
ORsunjdkMatch1.6.0update_12
ORsunjdkMatch1.6.0update_13
ORsunjdkMatch1.6.0update_14
ORsunjdkMatch1.6.0update_15
ORsunjdkMatch1.6.0update_16
ORsunjdkMatch1.6.0update_3
ORsunjdkMatch1.6.0update_4
ORsunjdkMatch1.6.0update_5
ORsunjdkMatch1.6.0update_6
ORsunjdkMatch1.6.0update_7
ORsunjdkMatch1.6.0update_8
ORsunjdkMatch1.6.0update_9
ORsunjdkMatch1.6.0update2
ORsunjreMatch1.4.2_01
ORsunjreMatch1.4.2_1
ORsunjreMatch1.4.2_2
ORsunjreMatch1.4.2_02
ORsunjreMatch1.4.2_03
ORsunjreMatch1.4.2_3
ORsunjreMatch1.4.2_4
ORsunjreMatch1.4.2_04
ORsunjreMatch1.4.2_05
ORsunjreMatch1.4.2_5
ORsunjreMatch1.4.2_06
ORsunjreMatch1.4.2_6
ORsunjreMatch1.4.2_7
ORsunjreMatch1.4.2_07
ORsunjreMatch1.4.2_8
ORsunjreMatch1.4.2_08
ORsunjreMatch1.4.2_09
ORsunjreMatch1.4.2_9
ORsunjreMatch1.4.2_10
ORsunjreMatch1.4.2_11
ORsunjreMatch1.4.2_12
ORsunjreMatch1.4.2_13
ORsunjreMatch1.4.2_14
ORsunjreMatch1.4.2_15
ORsunjreMatch1.4.2_16
ORsunjreMatch1.4.2_17
ORsunjreMatch1.4.2_18
ORsunjreMatch1.4.2_19
ORsunjreMatch1.4.2_20
ORsunjreMatch1.4.2_21
ORsunjreMatch1.4.2_22
ORsunjreMatch1.5.0update_1
ORsunjreMatch1.5.0update_11
ORsunjreMatch1.5.0update_12
ORsunjreMatch1.5.0update_13
ORsunjreMatch1.5.0update_14
ORsunjreMatch1.5.0update_15
ORsunjreMatch1.5.0update_16
ORsunjreMatch1.5.0update_17
ORsunjreMatch1.5.0update_18
ORsunjreMatch1.5.0update_19
ORsunjreMatch1.5.0update_2
ORsunjreMatch1.5.0update_20
ORsunjreMatch1.5.0update_21
ORsunjreMatch1.5.0update_3
ORsunjreMatch1.5.0update_4
ORsunjreMatch1.5.0update_5
ORsunjreMatch1.5.0update_6
ORsunjreMatch1.5.0update_7
ORsunjreMatch1.5.0update_8
ORsunjreMatch1.5.0update_9
ORsunjreMatch1.6.0update_1
ORsunjreMatch1.6.0update_10
ORsunjreMatch1.6.0update_11
ORsunjreMatch1.6.0update_12
ORsunjreMatch1.6.0update_13
ORsunjreMatch1.6.0update_14
ORsunjreMatch1.6.0update_15
ORsunjreMatch1.6.0update_16
ORsunjreMatch1.6.0update_2
ORsunjreMatch1.6.0update_3
ORsunjreMatch1.6.0update_4
ORsunjreMatch1.6.0update_5
ORsunjreMatch1.6.0update_6
ORsunjreMatch1.6.0update_7
ORsunjreMatch1.6.0update_8
ORsunjreMatch1.6.0update_9
ORsunsdkMatch1.4.2_1
ORsunsdkMatch1.4.2_2
ORsunsdkMatch1.4.2_02
ORsunsdkMatch1.4.2_03
ORsunsdkMatch1.4.2_3
ORsunsdkMatch1.4.2_04
ORsunsdkMatch1.4.2_4
ORsunsdkMatch1.4.2_5
ORsunsdkMatch1.4.2_05
ORsunsdkMatch1.4.2_6
ORsunsdkMatch1.4.2_06
ORsunsdkMatch1.4.2_07
ORsunsdkMatch1.4.2_7
ORsunsdkMatch1.4.2_8
ORsunsdkMatch1.4.2_08
ORsunsdkMatch1.4.2_09
ORsunsdkMatch1.4.2_9
ORsunsdkMatch1.4.2_10
ORsunsdkMatch1.4.2_11
ORsunsdkMatch1.4.2_12
ORsunsdkMatch1.4.2_13
ORsunsdkMatch1.4.2_14
ORsunsdkMatch1.4.2_15
ORsunsdkMatch1.4.2_16
ORsunsdkMatch1.4.2_17
ORsunsdkMatch1.4.2_18
ORsunsdkMatch1.4.2_19
ORsunsdkMatch1.4.2_20
ORsunsdkMatch1.4.2_21
ORsunsdkMatch1.4.2_22
| Vendor | Product | Version | CPE |
|---|---|---|---|
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_1:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_10:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_11:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_12:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_13:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_14:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_15:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_16:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_17:*:*:*:*:*:* |
| sun | jdk | 1.5.0 | cpe:2.3:a:sun:jdk:1.5.0:update_18:*:*:*:*:*:* |
References
java.sun.com/javase/6/webnotes/6u17.html
lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
marc.info/?l=bugtraq&m=126566824131534&w=2
marc.info/?l=bugtraq&m=131593453929393&w=2
marc.info/?l=bugtraq&m=134254866602253&w=2
secunia.com/advisories/37231
secunia.com/advisories/37239
secunia.com/advisories/37386
secunia.com/advisories/37581
secunia.com/advisories/37841
security.gentoo.org/glsa/glsa-200911-02.xml
securitytracker.com/id?1023132
sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1
support.apple.com/kb/HT3969
support.apple.com/kb/HT3970
www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
www.redhat.com/support/errata/RHSA-2009-1694.html
www.securityfocus.com/bid/36881
www.vupen.com/english/advisories/2009/3131
zerodayinitiative.com/advisories/ZDI-09-076/
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11903
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6746
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7750
Related
seebug
seebug
Sun Java JRE getSoundbank file:// URI Buffer Overflow
2014-07-01 00:00:00
exploitdb
exploitdb
Sun Java SE November 2009 - Multiple Vulnerabilities (2)
2009-10-29 00:00:00
Sun Java SE November 2009 - Multiple Vulnerabilities (1)
2009-10-29 00:00:00
nvd
nvd
CVE-2009-3867
2009-11-05 16:30:00
CVE-2010-0079
2010-01-13 01:30:01
veracode
veracode
Arbitrary Code Execution
2020-04-10 00:40:37
checkpoint_advisories
checkpoint_advisories
Sun Java HsbParser.getSoundBank Stack Buffer Overflow (CVE-2009-3867)
2010-02-02 00:00:00
canvas
canvas
Immunity Canvas: SUN_JAVA_HSBPARSER_LINUX
2009-11-05 16:30:00
Immunity Canvas: SUN_JAVA_HSBPARSER
2009-11-05 11:30:00
prion
prion
Stack overflow
2009-11-05 16:30:00
Code injection
2010-01-13 01:30:00
saint
saint
Java Runtime Environment HsbParser.getSoundBank Stack Buffer Overflow
2009-11-06 00:00:00
Java Runtime Environment HsbParser.getSoundBank Stack Buffer Overflow
2009-11-06 00:00:00
Java Runtime Environment HsbParser.getSoundBank Stack Buffer Overflow
2009-11-06 00:00:00
ubuntucve
ubuntucve
CVE-2009-3867
2009-11-05 00:00:00
zdi
zdi
Sun Java HsbParser.getSoundBank Stack Buffer Overflow Vulnerability
2009-11-04 00:00:00
metasploit
metasploit
Sun Java JRE getSoundbank file:// URI Buffer Overflow
2009-12-11 21:18:31
packetstorm
packetstorm
Sun Java JRE getSoundbank file:// URI Buffer Overflow
2009-12-31 00:00:00
Netragard Security Advisory 2009-12-19
2009-12-30 00:00:00
cvelist
cvelist
CVE-2009-3867
2009-11-05 16:00:00
CVE-2010-0079
2010-01-13 01:00:00
suse
suse
remote code execution in java-1_4_2-ibm
2010-01-12 17:42:00
remote code execution in java-1_5_0-ibm
2010-01-12 09:21:12
remote code execution in java-1_6_0-sun
2009-11-19 17:02:05
nessus
nessus
SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 6755)
2010-10-11 00:00:00
SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 6757)
2010-01-12 00:00:00
SuSE9 Security Update : IBM Java2 JRE and SDK (YOU Patch Number 12565)
2010-01-12 00:00:00
redhat
redhat
(RHSA-2010:0408) Moderate: java-1.4.2-ibm security update
2010-05-12 00:00:00
(RHSA-2009:1643) Critical: java-1.4.2-ibm security update
2009-12-07 00:00:00
(RHSA-2009:1647) Critical: java-1.5.0-ibm security update
2009-12-08 00:00:00
openvas
openvas
RedHat Security Advisory RHSA-2009:1647
2009-12-14 00:00:00
HP-UX Update for Java HPSBUX02503
2010-02-15 00:00:00
Sun Java JDK/JRE Multiple Vulnerabilities (Nov 2009) - Linux
2009-11-13 00:00:00
securityvulns
securityvulns
HP Network Node Manager i DoS
2011-09-20 00:00:00
Oracle Critical Patch Update Advisory - January 2010
2010-01-15 00:00:00
cve
cve
CVE-2010-0079
2010-01-13 01:30:01
oracle
oracle
Security | Oracle Critical Patch Update - January 2010
2010-01-12 00:00:00
vmware
vmware
VMware vCenter update release addresses multiple security issues in Java JRE
2010-01-29 00:00:00
VMware vCenter update release addresses multiple security issues in Java JRE
2010-01-29 00:00:00
gentoo
gentoo
Sun JDK/JRE: Multiple vulnerabilities
2009-11-17 00:00:00
CVSS2
9.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
AI Score
7.7
Confidence
Low
EPSS
0.932
Percentile
99.1%
Related for CVE-2009-3867