CVE-2009-2843

Java for Mac OS X 10.5-10.6 - Remote Code Execution via Expired Certificate Bypass

Title source: llm
STIX 2.1

Description

Java for Mac OS X 10.5 before Update 6 and 10.6 before Update 1 accepts expired certificates for applets, which makes it easier for remote attackers to execute arbitrary code via an applet.

References (6)

Core 6
Core References
Patch, Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT3970
Patch, Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT3969
Patch, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/37206
Patch, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37581

Scores

EPSS 0.0211
EPSS Percentile 79.9%

Details

CWE
CWE-310
Status published
Products (2)
apple/mac_os_x 10.5.8
apple/mac_os_x_server 10.5.8
Published Dec 08, 2009
Tracked Since Feb 18, 2026