deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3866
Published: 2009-11-05
Description: The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that points to an unintended trusted application, aka Bug Id 6872824.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
CVE: CVE-2009-3867
Published: 2009-11-05
Description: Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
CVE: CVE-2009-3868
Published: 2009-11-05
Description: Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 does not properly parse color profiles, which allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862970.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
CVE: CVE-2009-3869
Published: 2009-11-05
Description: Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
CVE: CVE-2009-3871
Published: 2009-11-05
Description: Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via crafted arguments, aka Bug Id 6872358.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
CVE: CVE-2009-3872
Published: 2009-11-05
Description: Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862969.
CVSS Score: 9.3 (HIGH)
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
CVE: CVE-2009-3873
Published: 2009-11-05
Description: The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, related to a "quantization problem," aka Bug Id 6862968.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
CVE: CVE-2009-3874
Published: 2009-11-05
Description: Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensions in a JPEG file that triggers a heap-based buffer overflow, aka Bug Id 6874643.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
CVE: CVE-2009-3875
Published: 2009-11-05
Description: The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital signatures, and possibly bypass authentication, via unspecified vectors related to "timing attack vulnerabilities," aka Bug Id 6863503.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
CVE: CVE-2009-3876
Published: 2009-11-05
Description: Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER encoded data, which is not properly decoded by the ASN.1 DER input stream parser, aka Bug Id 6864911.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1534&w=2
CVE: CVE-2009-3877
Published: 2009-11-05
Description: Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP headers, which are not properly parsed by the ASN.1 DER input stream parser, aka Bug Id 6864911.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
CVE: CVE-2009-3878
Published: 2009-11-05
Description: Buffer overflow in Sun Java System Web Server 7.0 Update 6 has unspecified impact and remote attack vectors, as demonstrated by the vd_sjws module in VulnDisco Pack Professional 8.12.  NOTE: as of 20091105, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/37115; http://www.h-online.com/security/news/item/Alleged-critical-vulnerability-in-Sun-Java-System-Web-Server-839598.html
CVE: CVE-2009-2685
Published: 2009-11-06
Description: Stack-based buffer overflow in the login form in the management web server in HP Power Manager allows remote attackers to execute arbitrary code via the Login variable.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2141&w=2; http://secunia.com/advisories/37276; http://securitytracker.com/id?1023140
CVE: CVE-2009-3300
Published: 2009-11-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/37237; http://shibboleth.internet2.edu/secadv/secadv_20091104.txt; http://www.debian.org/security/2009/dsa-1947
CVE: CVE-2009-3725
Published: 2009-11-06
Description: The connector layer in the Linux kernel before 2.6.31.5 does not require the CAP_SYS_ADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]6314&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1380&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]2235&w=2
CVE: CVE-2009-3850
Published: 2009-11-06
Description: Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.coresecurity.com/content/blender-scripting-injection; http://www.securityfocus.com/archive/1/507706/100/0/threaded; http://www.securityfocus.com/bid/36838
CVE: CVE-2009-3899
Published: 2009-11-06
Description: Memory leak in the Sockets Direct Protocol (SDP) driver in Sun Solaris 10, and OpenSolaris snv_57 through snv_94, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://securitytracker.com/id?1023124; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141444-09-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-264730-1
CVE: CVE-2009-3900
Published: 2009-11-06
Description: Unspecified vulnerability in the Cluster Management component in IBM PowerHA 5.4, 5.4.1, 5.5, and 6.1 on AIX allows remote attackers to modify the operating-system configuration via packets to the godm port (6177/tcp).
CVSS Score: 7.8 (HIGH)
References: http://aix.software.ibm.com/aix/efixes/security/haport_advisory.asc; http://secunia.com/advisories/37267; http://www-01.ibm.com/support/docview.wss?uid=isg1IZ61323
CVE: CVE-2009-3901
Published: 2009-11-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web script or HTML via the UserGUID parameter to home/index.asp and other unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0911-exploits/ecourier-xss.txt; http://secunia.com/advisories/37240; http://packetstormsecurity.org/0911-exploits/ecourier-xss.txt
CVE: CVE-2009-3902
Published: 2009-11-06
Description: Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a /\.. (slash backslash dot dot) in the URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://freetexthost.com/ncyss3plli; http://osvdb.org/59588; http://pocoftheday.blogspot.com/2009/10/cherokee-web-server-054-directory.html
CVE: CVE-2009-3903
Published: 2009-11-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in jspui/index.jsp in ManageEngine Netflow Analyzer 7.5 build 7500 allow remote attackers to inject arbitrary web script or HTML via the (1) view and (2) section parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55772; http://secunia.com/advisories/35105; http://www.securityfocus.com/bid/35630
CVE: CVE-2009-3904
Published: 2009-11-06
Description: classes/session/cc_admin_session.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request that contains an empty (1) sessID (ccAdmin cookie), (2) X_CLUSTER_CLIENT_IP header, or (3) User-Agent header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://forums.cubecart.com/index.php?showtopic=39691?read=1; http://forums.cubecart.com/index.php?showtopic=39748; http://secunia.com/advisories/37197
CVE: CVE-2009-3905
Published: 2009-11-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web script or HTML via the UserGUID parameter to (1) Wizard_tracking.asp, (2) wizard_oe2.asp, (3) your-register.asp, (4) main-whyregister.asp, and (5) your.asp in home/, and other unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37240; http://secunia.com/advisories/37240
CVE: CVE-2009-3555
Published: 2009-11-09
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-295
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html; http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html; http://blogs.iss.net/archive/sslmitmiscsrf.html
CVE: CVE-2009-3911
Published: 2009-11-09
Description: Cross-site scripting (XSS) vulnerability in settings.php in TFTgallery 0.13 allows remote attackers to inject arbitrary web script or HTML via the sample parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0911-exploits/tftgallery-traversal.txt; http://secunia.com/advisories/37156; http://www.securityfocus.com/bid/36898
CVE: CVE-2009-3912
Published: 2009-11-09
Description: Directory traversal vulnerability in index.php in TFTgallery 0.13 allows remote attackers to read arbitrary files via a ..%2F (encoded dot dot slash) in the album parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/0911-exploits/tftgallery-traversal.txt; http://secunia.com/advisories/37156; http://www.securityfocus.com/bid/36899
CVE: CVE-2009-3913
Published: 2009-11-09
Description: SQL injection vulnerability in summary.php in Xerox Fiery Webtools allows remote attackers to execute arbitrary SQL commands via the select parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/507650/100/0/threaded; http://www.securityfocus.com/bid/36906; https://exchange.xforce.ibmcloud.com/vulnerabilities/54137
CVE: CVE-2009-3914
Published: 2009-11-09
Description: Cross-site scripting (XSS) vulnerability in the Temporary Invitation module 5.x before 5.x-2.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the Name field in an invitation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/623018; http://drupal.org/node/623526; http://osvdb.org/59679
CVE: CVE-2009-3915
Published: 2009-11-09
Description: Cross-site scripting (XSS) vulnerability in the "Separate title and URL" formatter in the Link module 5.x before 5.x-2.6 and 6.x before 6.x-2.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the link title field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/620662; http://drupal.org/node/620668; http://drupal.org/node/623562
CVE: CVE-2009-3916
Published: 2009-11-09
Description: Cross-site scripting (XSS) vulnerability in the Node Hierarchy module 5.x before 5.x-1.3 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a child node title.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/622092; http://drupal.org/node/622100; http://drupal.org/node/623490
CVE: CVE-2009-3917
Published: 2009-11-09
Description: Cross-site scripting (XSS) vulnerability in the S5 Presentation Player module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via an unspecified field that is copied to the HTML HEAD element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/623508; http://osvdb.org/59678; http://secunia.com/advisories/37285
CVE: CVE-2009-3918
Published: 2009-11-09
Description: Cross-site scripting (XSS) vulnerability in the Zoomify module 5.x before 5.x-2.2 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the node title.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/623434; http://drupal.org/node/623436; http://drupal.org/node/623678
CVE: CVE-2009-3919
Published: 2009-11-09
Description: Cross-site scripting (XSS) vulnerability in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified "user-supplied information."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/623506; http://drupal.org/node/623546; http://osvdb.org/59676
CVE: CVE-2009-3920
Published: 2009-11-09
Description: An administration page in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal does not perform the expected access control, which allows remote attackers to read log information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/623506; http://drupal.org/node/623546; http://osvdb.org/59677
CVE: CVE-2009-3921
Published: 2009-11-09
Description: The Smartqueue_og module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-rc3, a module for Drupal, does not verify group-node privileges in certain circumstances involving subqueue creation, which allows remote authenticated users to discover arbitrary organic group names by reading confirmation messages.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/617496; http://drupal.org/node/617500; http://drupal.org/node/623554
CVE: CVE-2009-3922
Published: 2009-11-09
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the User Protect module 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allow remote attackers to hijack the authentication of administrators for requests that (1) delete the editing protection of a user or (2) delete a certain type of administrative-bypass rule.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/623162; http://drupal.org/node/623180; http://drupal.org/node/623186
CVE: CVE-2009-3726
Published: 2009-11-09
Description: The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d953126a28f97ec965d23c69fd5795854c048f30; http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html
CVE: CVE-2009-3728
Published: 2009-11-09
Description: Directory traversal vulnerability in the ICC_Profile.getInstance method in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local International Color Consortium (ICC) profile files via a .. (dot dot) in a pathname, aka Bug Id 6631533.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html; http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
CVE: CVE-2009-3729
Published: 2009-11-09
Description: Unspecified vulnerability in the TrueType font parsing functionality in Sun Java SE 5.0 before Update 22 and 6 before Update 17 allows remote attackers to cause a denial of service (application crash) via a certain test suite, aka Bug Id 6815780.
CVSS Score: 5.0 (MEDIUM)
References: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html; http://java.sun.com/javase/6/webnotes/6u17.html; http://secunia.com/advisories/37386
CVE: CVE-2009-3879
Published: 2009-11-09
Description: Multiple unspecified vulnerabilities in the (1) X11 and (2) Win32GraphicsDevice subsystems in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and attack vectors, related to failure to clone arrays that are returned by the getConfigurations function, aka Bug Id 6822057.
CVSS Score: 7.5 (HIGH)
References: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html; http://java.sun.com/javase/6/webnotes/6u17.html; http://secunia.com/advisories/37386
CVE: CVE-2009-3880
Published: 2009-11-09
Description: The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager, aka Bug Id 6664512.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html; http://java.sun.com/javase/6/webnotes/6u17.html; http://secunia.com/advisories/37386
CVE: CVE-2009-3881
Published: 2009-11-09
Description: Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak vulnerability," aka Bug Id 6636650.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html; http://java.sun.com/javase/6/webnotes/6u17.html; http://secunia.com/advisories/37386
CVE: CVE-2009-3882
Published: 2009-11-09
Description: Multiple unspecified vulnerabilities in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657026.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html; http://java.sun.com/javase/6/webnotes/6u17.html; http://secunia.com/advisories/37386
CVE: CVE-2009-3883
Published: 2009-11-09
Description: Multiple unspecified vulnerabilities in the Windows Pluggable Look and Feel (PL&F) feature in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657138.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html; http://java.sun.com/javase/6/webnotes/6u17.html; http://secunia.com/advisories/37386