CVE-2009-1106

JDK and JRE 6 Update 10-12 - Improper Input Validation in Crossdomain.xml Parser

Title source: llm

Description

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.

References (25)

Core 25

Core References

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html

Vendor Advisory vendor-advisory x_refsource_hp

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35156

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6619

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/37460

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-200911-02.xml

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2009-1038.html

Vendor Advisory vendor-advisory x_refsource_redhat

https://rhn.redhat.com/errata/RHSA-2009-1198.html

Vendor Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Mailing List vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=124344236532162&w=2

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/36185

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35255

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/1426

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2009-0392.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/49459

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/34240

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34496

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1021920

Patch, Vendor Advisory vendor-advisory x_refsource_sunalert

http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1

Patch x_refsource_misc

http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1

Vendor Advisory x_refsource_confirm

http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/37386

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/3316

Scores

EPSS 0.0139

EPSS Percentile 80.6%

Details

CWE

CWE-20

Status published

Products (2)

sun/jdk 1.6.0 update_10 (3 CPE variants)

sun/jre 1.6.0 update_10 (3 CPE variants)

Published Mar 25, 2009

Tracked Since Feb 18, 2026