Buffer overflow in Sun Jre

CVE-2009-1671

Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allow remote attackers to execute arbitrary code via a long string argument to the (1) setInstallerType, (2) setAdditionalPackages, (3) compareVersion, (4) getStaticCLSID, or (5) launch method.

Vulnerability class: Buffer Overflow

EPSS: 0.103 (95.2th percentile) — read the EPSS interpretation.

Affected products

Sun Jre — versions 6
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
cve@mitre.org (URL Repurposed, Exploit, x_refsource_MISC)
cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)