CVE-2009-2674

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-08-05 · updated 2026-06-16
Weakness: CWE-264

Description

Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow.

Affected products

Sun Jdk: 1.6.0-update2, 6-update_1, 6-update_10, 6-update_11, 6-update_12, 6-update_13 (+8)
Sun Jre: 6-update_1, 6-update_10, 6-update_11, 6-update_12, 6-update_13, 6-update_2 (+7)

References

http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
http://marc.info/?l=bugtraq&m=125787273209737&w=2
http://secunia.com/advisories/36162
http://secunia.com/advisories/36176
http://secunia.com/advisories/36180
http://secunia.com/advisories/36248
http://secunia.com/advisories/37300
http://secunia.com/advisories/37386
http://security.gentoo.org/glsa/glsa-200911-02.xml

Get alerted when CVE-2009-2674 or the next vulnerability affects your stack