CVE-2009-3880 Information disclosure in n/a

Medium 5.0 Published 9 Nov 2009 Updated 7 Aug 2024

Attackers can obtain sensitive information via improper object restrictions in Java AWT loggers, affecting Java Runtime Environment users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-3880?

CVE-2009-3880 is a medium-severity vulnerability in Sun Jre, published on 9 Nov 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager, aka Bug Id 6664512.

Weakness: CWE-264

Which versions are affected by CVE-2009-3880?

It affects 2 products.

Products include Sun Jre, Sun Openjdk.

How do I fix CVE-2009-3880?

Upgrade to a fixed version.

Is CVE-2009-3880 being exploited?

There is no known exploitation of CVE-2009-3880 in the wild and no public exploit code.

All Sun Jre vulnerabilities

Sources

Also known as GHSA-2q37-8v55-frjg.