CVE-2009-3877

Sun JDK/JRE DoS via ASN.1 DER Input Stream Parser (5.0 < U22, 6 < U17, 1.3.x < 1.3.1_27, 1.4.x < 1.4.2_24)

Title source: llm
STIX 2.1

Description

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP headers, which are not properly parsed by the ASN.1 DER input stream parser, aka Bug Id 6864911.

References (24)

Core 24
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200911-02.xml
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=126566824131534&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/36881
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT3970
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT3969
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7148
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=131593453929393&w=2
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2009-1694.html
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37231
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10469
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/3131
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37581
Vendor Advisory x_refsource_confirm
http://java.sun.com/javase/6/webnotes/6u17.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37841
Patch, Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270476-1
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12232
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37239
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37386
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8330

Scores

EPSS 0.1015
EPSS Percentile 93.2%

Details

CWE
CWE-399
Status published
Products (13)
sun/jdk 1.5.0 update1 (23 CPE variants)
sun/jdk 1.6.0 update1 (16 CPE variants)
sun/jre 1.4.2_1
sun/jre 1.4.2_2
sun/jre 1.4.2_02
sun/jre 1.4.2_03
sun/jre 1.4.2_3
sun/jre 1.4.2_4
sun/jre 1.4.2_04
sun/jre 1.4.2_05
... and 3 more
Published Nov 05, 2009
Tracked Since Feb 18, 2026