CVE-2009-2475 Information disclosure in n/a
Attackers can obtain sensitive information via static variables in Java SE libraries, potentially exposing internal data to context-dependent attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-2475?
CVE-2009-2475 is a high-severity vulnerability in n/a, published on 10 Aug 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.
Weakness: CWE-200
Which versions are affected by CVE-2009-2475?
It affects 2 products.
Products include Sun Java Se, Sun Openjdk.
How do I fix CVE-2009-2475?
Upgrade to a fixed version.
Is CVE-2009-2475 being exploited?
There is no known exploitation of CVE-2009-2475 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2vx8-fp5p-f94q.