CVE-2009-1719

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-06-16 · updated 2026-06-16
Weakness: CWE-94

Description

The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to the undocumented apple.laf.CColourUIResource constructor with a crafted value in the first argument, which is dereferenced as a pointer.

Affected products

Sun Jre: 1.5.0, 1.5.0-update1, 1.5.0-update10, 1.5.0-update11, 1.5.0-update12, 1.5.0-update13 (+13)

References

http://lists.apple.com/archives/security-announce/2009/Jun/msg00003.html
http://support.apple.com/kb/HT3632
http://www.securityfocus.com/archive/1/504364/100/0/threaded
http://www.securityfocus.com/bid/35381
http://www.securityfocus.com/bid/35401
http://www.zerodayinitiative.com/advisories/ZDI-09-043
https://exchange.xforce.ibmcloud.com/vulnerabilities/51185
http://lists.apple.com/archives/security-announce/2009/Jun/msg00003.html
http://support.apple.com/kb/HT3632
http://www.securityfocus.com/archive/1/504364/100/0/threaded
http://www.securityfocus.com/bid/35381
http://www.securityfocus.com/bid/35401

Get alerted when CVE-2009-1719 or the next vulnerability affects your stack