What’s Vulnerable › Vulnerabilities

CVE-2009-3877

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-11-05 · updated 2026-06-16
• Weakness: CWE-399

Description

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP headers, which are not properly parsed by the ASN.1 DER input stream parser, aka Bug Id 6864911.

Affected products

• Sun Jdk: 1.5.0-update1, 1.5.0-update10, 1.5.0-update11, 1.5.0-update11_b03, 1.5.0-update12, 1.5.0-update13 (+33)
• Sun Jre: 1.4.2_1, 1.4.2_2, 1.4.2_02, 1.4.2_03, 1.4.2_3, 1.4.2_4 (+97)
• Sun Sdk: 1.4.2_01, 1.4.2_1, 1.4.2_2, 1.4.2_02, 1.4.2_03, 1.4.2_3 (+60)

References

• http://java.sun.com/javase/6/webnotes/6u17.html
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
• http://marc.info/?l=bugtraq&m=126566824131534&w=2
• http://marc.info/?l=bugtraq&m=131593453929393&w=2
• http://secunia.com/advisories/37231
• http://secunia.com/advisories/37239
• http://secunia.com/advisories/37386
• http://secunia.com/advisories/37581
• http://secunia.com/advisories/37841
• http://security.gentoo.org/glsa/glsa-200911-02.xml

Get alerted when CVE-2009-3877 or the next vulnerability affects your stack