← Vulnerability feed

Vulnerability record · CVE-2009-1103 · published 25 March 2009

CVE-2009-1103: Sun java vulnerability

Sun · Java

Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to "deserializing applets," aka CR 6646860.

6.4 CVSS 2.0 Medium EPSS 4.5% · top 8.8%
6.4CVSS 2.0 base score
4.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
58References
16 Jun 2026Last modified by NVD

Description

Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to "deserializing applets," aka CR 6646860.

AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
http://marc.info/?l=bugtraq&m=124344236532162&w=2
http://secunia.com/advisories/34495
http://secunia.com/advisories/34496
http://secunia.com/advisories/35156
http://secunia.com/advisories/35255
http://secunia.com/advisories/35416
http://secunia.com/advisories/36185
http://secunia.com/advisories/37386
http://secunia.com/advisories/37460
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1 PatchVendor Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm
http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm
http://www.redhat.com/support/errata/RHSA-2009-0392.html
http://www.redhat.com/support/errata/RHSA-2009-0394.html
http://www.redhat.com/support/errata/RHSA-2009-1038.html
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/bid/34240
http://www.securitytracker.com/id?1021920
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/1426
http://www.vupen.com/english/advisories/2009/3316
https://exchange.xforce.ibmcloud.com/vulnerabilities/49456
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6542
https://rhn.redhat.com/errata/RHSA-2009-1198.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
http://marc.info/?l=bugtraq&m=124344236532162&w=2
http://secunia.com/advisories/34495
http://secunia.com/advisories/34496
http://secunia.com/advisories/35156
http://secunia.com/advisories/35255
http://secunia.com/advisories/35416
http://secunia.com/advisories/36185

Track CVE-2009-1103 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2010-0887Sun java vulnerabilityUnspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows remote atta…EPSS 9.4%10.0CVE-2005-2529Sun java vulnerabilityUnspecified vulnerability in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to gain privileges via unspecified attack vectors…EPSS 2.3%10.0CVE-2005-2530Sun java vulnerabilityUnspecified vulnerability in Java 1.3.1 before 1.3.1_16 on Apple Mac OS X allows an untrusted applet to gain privileges, related to "Mac OS X specifi…EPSS 2.5%7.5CVE-2009-1105Sun java vulnerabilityThe Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to…EPSS 3.6%7.5CVE-2008-3440Sun java code injection vulnerabilitySun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-mi…EPSS 2.4%7.5CVE-1999-0440Netscape communicator vulnerabilityThe byte code verifier component of the Java Virtual Machine (JVM) allows remote execution through malicious web pages.EPSS 3.6%7.5CVE-1999-0142Netscape navigator vulnerabilityThe Java Applet Security Manager implementation in Netscape Navigator 2.0 and Java Developer's Kit 1.0 allows an applet to connect to arbitrary hosts.EPSS 1.6%6.4CVE-2009-1102Sun java code injection vulnerabilityUnspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows r…EPSS 4.6%

Source: NIST National Vulnerability Database (record CVE-2009-1103), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.