CVE-2009-2672 Information disclosure in n/a

What is CVE-2009-2672?

CVE-2009-2672 is a high-severity vulnerability in Sun Jdk, published on 5 Aug 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors.

Weakness: CWE-264

Which versions are affected by CVE-2009-2672?

It affects 2 products.

Products include Sun Jdk, Sun Jre.

How do I fix CVE-2009-2672?

Upgrade to a fixed version.

Is CVE-2009-2672 being exploited?

There is no known exploitation of CVE-2009-2672 in the wild and no public exploit code.

Other vulnerabilities in Sun Jdk

• CVE-2011-3521 Deserialization in n/a Critical 10.0
• CVE-2011-3548 Other in n/a Critical 10.0
• CVE-2011-3549 Other in n/a Critical 10.0
• CVE-2011-3554 Other in n/a Critical 10.0
• CVE-2011-0802 Other in n/a Critical 10.0

All Sun Jdk vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fj22-5g9h-44w5.