CVE-2009-3885

Sun JRE < 1.5.0 Update 22 and < 1.6.0 Update 17 - Denial of Service via BMP ICC Profile UNC Path

Title source: llm

Description

Sun Java SE 5.0 before Update 22 and 6 before Update 17 on Windows allows remote attackers to cause a denial of service via a BMP file containing a link to a UNC share pathname for an International Color Consortium (ICC) profile file, probably a related issue to CVE-2007-2789, aka Bug Id 6632445.

References (5)

Core 5

Core References

Issue Tracking x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=530114

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7094

Various Sources x_refsource_confirm

http://java.sun.com/javase/6/webnotes/6u17.html

Various Sources x_refsource_confirm

http://java.sun.com/j2se/1.5.0/ReleaseNotes.html

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2010:084

Scores

EPSS 0.0089

EPSS Percentile 75.8%

Details

Status published

Products (6)

sun/jre 1.5.0 update_1 (19 CPE variants)

sun/jre 1.6.0 update_1 (15 CPE variants)

sun/jre 1.6.0_0

sun/jre 1.6.0_10

sun/jre < 1.5.0

sun/jre < 1.6.0

Published Nov 09, 2009

Tracked Since Feb 18, 2026