← Vulnerability feed

Vulnerability record · CVE-2009-1105 · published 25 March 2009

CVE-2009-1105: Sun java vulnerability

Sun · Java

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to cause a trusted applet to run in an older JRE version, which can be used to exploit vulnerabilities in that older version, aka CR 6706490.

7.5 CVSS 2.0 High EPSS 3.6% · top 11.1%
7.5CVSS 2.0 base score
3.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
56References
16 Jun 2026Last modified by NVD

Description

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to cause a trusted applet to run in an older JRE version, which can be used to exploit vulnerabilities in that older version, aka CR 6706490.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
http://lists.apple.com/archives/security-announce/2010//May/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
http://marc.info/?l=bugtraq&m=124344236532162&w=2
http://secunia.com/advisories/34496
http://secunia.com/advisories/35156
http://secunia.com/advisories/35255
http://secunia.com/advisories/36185
http://secunia.com/advisories/37386
http://secunia.com/advisories/37460
http://secunia.com/advisories/39819
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1 PatchVendor Advisory
http://support.apple.com/kb/HT4171
http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm
http://www.redhat.com/support/errata/RHSA-2009-0392.html
http://www.redhat.com/support/errata/RHSA-2009-1038.html
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/bid/34240
http://www.securitytracker.com/id?1021920
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/1426
http://www.vupen.com/english/advisories/2009/3316
http://www.vupen.com/english/advisories/2010/1191
https://exchange.xforce.ibmcloud.com/vulnerabilities/49458
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6642
https://rhn.redhat.com/errata/RHSA-2009-1198.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
http://lists.apple.com/archives/security-announce/2010//May/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
http://marc.info/?l=bugtraq&m=124344236532162&w=2
http://secunia.com/advisories/34496
http://secunia.com/advisories/35156
http://secunia.com/advisories/35255
http://secunia.com/advisories/36185
http://secunia.com/advisories/37386
http://secunia.com/advisories/37460
http://secunia.com/advisories/39819

Track CVE-2009-1105 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2010-0887Sun java vulnerabilityUnspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows remote atta…EPSS 9.4%10.0CVE-2005-2529Sun java vulnerabilityUnspecified vulnerability in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to gain privileges via unspecified attack vectors…EPSS 2.3%10.0CVE-2005-2530Sun java vulnerabilityUnspecified vulnerability in Java 1.3.1 before 1.3.1_16 on Apple Mac OS X allows an untrusted applet to gain privileges, related to "Mac OS X specifi…EPSS 2.5%7.5CVE-2008-3440Sun java code injection vulnerabilitySun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-mi…EPSS 2.4%7.5CVE-1999-0440Netscape communicator vulnerabilityThe byte code verifier component of the Java Virtual Machine (JVM) allows remote execution through malicious web pages.EPSS 3.6%7.5CVE-1999-0142Netscape navigator vulnerabilityThe Java Applet Security Manager implementation in Netscape Navigator 2.0 and Java Developer's Kit 1.0 allows an applet to connect to arbitrary hosts.EPSS 1.6%6.4CVE-2009-1102Sun java code injection vulnerabilityUnspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows r…EPSS 4.6%6.4CVE-2009-1103Sun java vulnerabilityUnspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update…EPSS 4.5%

Source: NIST National Vulnerability Database (record CVE-2009-1105), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.