CVE-2009-3884 Information disclosure in n/a

Medium 5.0 Published 9 Nov 2009 Updated 7 Aug 2024

Remote attackers can determine the existence of local files via the TimeZone.getTimeZone method in Java SE and OpenJDK.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-3884?

CVE-2009-3884 is a medium-severity vulnerability in Sun Jre, published on 9 Nov 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local files via vectors related to handling of zoneinfo (aka tz) files, aka Bug Id 6824265.

Which versions are affected by CVE-2009-3884?

It affects 2 products.

Products include Sun Jre, Sun Openjdk.

How do I fix CVE-2009-3884?

Upgrade to a fixed version.

Is CVE-2009-3884 being exploited?

There is no known exploitation of CVE-2009-3884 in the wild and no public exploit code.

All Sun Jre vulnerabilities

Sources

Also known as GHSA-pc3p-mx4p-7j4f.