CVE-2009-2475: Infoleak
Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARDINPUTTYPE, (5) ImageWriterSpi.STANDARDOUTPUTTYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2475?
CVE-2009-2475 is considered a moderate severity vulnerability due to potential information disclosure.
How do I fix CVE-2009-2475?
To fix CVE-2009-2475, upgrade to Sun Java SE version 5.0 Update 20 or later, or version 6 Update 15 or later.
What types of software are affected by CVE-2009-2475?
CVE-2009-2475 affects Sun Java SE versions prior to Update 20 and 6 prior to Update 15, as well as OpenJDK implementations.
What kind of attacks are possible with CVE-2009-2475?
CVE-2009-2475 may allow context-dependent attackers to exploit static variables declared without the final keyword.
Is CVE-2009-2475 still a threat today?
While CVE-2009-2475 has been mitigated in later updates, systems still running vulnerable versions may remain at risk.