Buffer overflow in Microsoft Windows
CVE-2009-3869
Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.
Vulnerability class: Buffer Overflow
EPSS: 0.655 (99.2th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Windows
- Sun Java_se
- Sun Jdk — versions 1.5.0, 1.6.0
- Sun Jre — versions 1.5.0, 1.6.0, 1.4.2_1
- Sun Sdk — versions 1.4.2_01, 1.4.2_1, 1.4.2_2
- Sun Solaris
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_HP, vendor-advisory)
- cve@mitre.org (signature, x_refsource_OVAL, vdb-entry)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_HP, vendor-advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_HP, vendor-advisory)
- cve@mitre.org (vendor-advisory, x_refsource_GENTOO)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (signature, x_refsource_OVAL, vdb-entry)
Frequently asked questions
- What is CVE-2009-3869?
- CVE-2009-3869 is a vulnerability in Microsoft Windows, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2009-11-05.
- Is CVE-2009-3869 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.