CVE-2009-1095: Integer Overflow

Q: What is the severity of CVE-2009-1095?

CVE-2009-1095 is classified as a high-severity vulnerability due to the potential for remote code execution.

Q: How do I fix CVE-2009-1095?

To fix CVE-2009-1095, upgrade to the latest version of the Java SE Development Kit or Java Runtime Environment that is not affected.

Q: Which Java versions are affected by CVE-2009-1095?

CVE-2009-1095 affects Java SE Development Kit (JDK) 5.0 Update 17 and earlier, as well as JRE 5.0 and 6 Update 12 and earlier.

Q: Can CVE-2009-1095 allow unauthorized access to my system?

Yes, CVE-2009-1095 can potentially allow remote attackers to access files or execute arbitrary code on affected systems.

Q: Is there a workaround for CVE-2009-1095?

Disabling the use of Pack200 compression in JAR files can serve as a temporary workaround for CVE-2009-1095.

Published Mar 25, 2009

Updated

Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.

Affected Software

61 affected components

Java Development Kit (JDK)<=1.5.0

Java Development Kit (JDK)=1.5.0

Java Development Kit (JDK)=1.5.0-update1

Java Development Kit (JDK)=1.5.0-update10

Java Development Kit (JDK)=1.5.0-update11

Java Development Kit (JDK)=1.5.0-update11_b03

Java Development Kit (JDK)=1.5.0-update12

Java Development Kit (JDK)=1.5.0-update13

Java Development Kit (JDK)=1.5.0-update14

Java Development Kit (JDK)=1.5.0-update15

Java Development Kit (JDK)=1.5.0-update16

Java Development Kit (JDK)=1.5.0-update2

Java Development Kit (JDK)=1.5.0-update3

Java Development Kit (JDK)=1.5.0-update4

Java Development Kit (JDK)=1.5.0-update5

Java Development Kit (JDK)=1.5.0-update6

Java Development Kit (JDK)=1.5.0-update7

Java Development Kit (JDK)=1.5.0-update7_b03

Java Development Kit (JDK)=1.5.0-update8

Java Development Kit (JDK)=1.5.0-update9

Sun Java Runtime Environment (JRE)<=1.5.0

Sun Java Runtime Environment (JRE)=1.5.0

Sun Java Runtime Environment (JRE)=1.5.0-update1

Sun Java Runtime Environment (JRE)=1.5.0-update10

Sun Java Runtime Environment (JRE)=1.5.0-update11

Sun Java Runtime Environment (JRE)=1.5.0-update12

Sun Java Runtime Environment (JRE)=1.5.0-update13

Sun Java Runtime Environment (JRE)=1.5.0-update14

Sun Java Runtime Environment (JRE)=1.5.0-update15

Sun Java Runtime Environment (JRE)=1.5.0-update16

Sun Java Runtime Environment (JRE)=1.5.0-update2

Sun Java Runtime Environment (JRE)=1.5.0-update3

Sun Java Runtime Environment (JRE)=1.5.0-update4

Sun Java Runtime Environment (JRE)=1.5.0-update5

Sun Java Runtime Environment (JRE)=1.5.0-update6

Sun Java Runtime Environment (JRE)=1.5.0-update7

Sun Java Runtime Environment (JRE)=1.5.0-update8

Sun Java Runtime Environment (JRE)=1.5.0-update9

Java Development Kit (JDK)<=1.6.0

Java Development Kit (JDK)=1.6.0

Java Development Kit (JDK)=1.6.0-update_10

Java Development Kit (JDK)=1.6.0-update_11

Java Development Kit (JDK)=1.6.0-update_3

Java Development Kit (JDK)=1.6.0-update_4

Java Development Kit (JDK)=1.6.0-update_5

Java Development Kit (JDK)=1.6.0-update_6

Java Development Kit (JDK)=1.6.0-update_7

Java Development Kit (JDK)=1.6.0-update1

Java Development Kit (JDK)=1.6.0-update1_b06

Java Development Kit (JDK)=1.6.0-update2

Sun Java Runtime Environment (JRE)<=1.6.0

Sun Java Runtime Environment (JRE)=1.6.0

Sun Java Runtime Environment (JRE)=1.6.0-update_1

Sun Java Runtime Environment (JRE)=1.6.0-update_10

Sun Java Runtime Environment (JRE)=1.6.0-update_11

Sun Java Runtime Environment (JRE)=1.6.0-update_2

Sun Java Runtime Environment (JRE)=1.6.0-update_3

Sun Java Runtime Environment (JRE)=1.6.0-update_4

Sun Java Runtime Environment (JRE)=1.6.0-update_5

Sun Java Runtime Environment (JRE)=1.6.0-update_6

Sun Java Runtime Environment (JRE)=1.6.0-update_7

Remediation

Patch Available

http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1

Patch Available

http://sunsolve.sun.com/search/document.do?assetkey=1-26-254570-1

Event History

Mar 25, 2009

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Data Sourced

via NVD·11:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-1095?

CVE-2009-1095 is classified as a high-severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2009-1095?

To fix CVE-2009-1095, upgrade to the latest version of the Java SE Development Kit or Java Runtime Environment that is not affected.

Which Java versions are affected by CVE-2009-1095?

CVE-2009-1095 affects Java SE Development Kit (JDK) 5.0 Update 17 and earlier, as well as JRE 5.0 and 6 Update 12 and earlier.

Can CVE-2009-1095 allow unauthorized access to my system?

Yes, CVE-2009-1095 can potentially allow remote attackers to access files or execute arbitrary code on affected systems.

Is there a workaround for CVE-2009-1095?

Disabling the use of Pack200 compression in JAR files can serve as a temporary workaround for CVE-2009-1095.

CVE-2009-1095: Integer Overflow

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2009-1095?

How do I fix CVE-2009-1095?

Which Java versions are affected by CVE-2009-1095?

Can CVE-2009-1095 allow unauthorized access to my system?

Is there a workaround for CVE-2009-1095?

Company

Resources

Contact