CVE-2009-2670 Information disclosure in n/a

What is CVE-2009-2670?

CVE-2009-2670 is a medium-severity vulnerability in Sun Jdk, published on 5 Aug 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.

Weakness: CWE-264

Which versions are affected by CVE-2009-2670?

It affects 2 products.

Products include Sun Jdk, Sun Jre.

How do I fix CVE-2009-2670?

Upgrade to a fixed version.

Is CVE-2009-2670 being exploited?

There is no known exploitation of CVE-2009-2670 in the wild and no public exploit code.

Other vulnerabilities in Sun Jdk

• CVE-2011-3521 Deserialization in n/a Critical 10.0
• CVE-2011-3548 Other in n/a Critical 10.0
• CVE-2011-3549 Other in n/a Critical 10.0
• CVE-2011-3554 Other in n/a Critical 10.0
• CVE-2011-0802 Other in n/a Critical 10.0

All Sun Jdk vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6jqw-6g89-r7rg.