Vulnerability record · CVE-2009-1896 · published 10 August 2009

CVE-2009-1896: Sun openjdk permissions and access controls vulnerability

Sun · Openjdk

The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.

10.0 CVSS 2.0 High EPSS 3.0% · top 13.0% CWE-264 · Permissions and access controls

10.0CVSS 2.0 base score

3.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

10References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Openjdk Sun

References

Link	Tags
http://secunia.com/advisories/36162	Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
https://bugzilla.redhat.com/show_bug.cgi?id=512101
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
http://secunia.com/advisories/36162	Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
https://bugzilla.redhat.com/show_bug.cgi?id=512101
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html

Track CVE-2009-1896 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2009-2476Sun java se permissions and access controls vulnerabilityThe Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which …EPSS 2.9%10 Aug 2009 10.0CVE-2009-2689Sun java se permissions and access controls vulnerabilityJDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecifie…EPSS 2.8%10 Aug 2009 9.3CVE-2009-0723Gimp integer overflow vulnerabilityMultiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependen…EPSS 5.0%23 Mar 2009 9.3CVE-2009-0733Gimp out-of-bounds write vulnerabilityMultiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta…EPSS 5.5%23 Mar 2009 7.8CVE-2009-2475Sun java se information exposure vulnerabilitySun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vec…EPSS 2.3%10 Aug 2009 7.5CVE-2009-3879Sun jre vulnerabilityMultiple unspecified vulnerabilities in the (1) X11 and (2) Win32GraphicsDevice subsystems in Sun Java SE 5.0 before Update 22 and 6 before Update 17…EPSS 2.3%9 Nov 2009 7.5CVE-2009-3881Sun jre information exposure vulnerabilitySun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which …EPSS 2.7%9 Nov 2009 7.5CVE-2009-3882Sun openjdk information exposure vulnerabilityMultiple unspecified vulnerabilities in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknow…EPSS 2.0%9 Nov 2009

Source: NIST National Vulnerability Database (record CVE-2009-1896), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.