Vulnerability record · CVE-2009-2475 · published 10 August 2009

CVE-2009-2475: Sun java se information exposure vulnerability

Sun · Java Se

Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.

7.8 CVSS 2.0 High EPSS 2.3% · top 17.2% CWE-200 · Information exposure

7.8CVSS 2.0 base score

2.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

42References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:C/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Java Se Sun

Openjdk Sun

References

Link	Tags
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html	Vendor Advisory
http://java.sun.com/javase/6/webnotes/6u15.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://secunia.com/advisories/36162	Vendor Advisory
http://secunia.com/advisories/36176	Vendor Advisory
http://secunia.com/advisories/36180	Vendor Advisory
http://secunia.com/advisories/36199	Vendor Advisory
http://secunia.com/advisories/37386
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1	PatchVendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1	Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
http://www.vupen.com/english/advisories/2009/2543
https://bugzilla.redhat.com/show_bug.cgi?id=513215
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10221
https://rhn.redhat.com/errata/RHSA-2009-1199.html
https://rhn.redhat.com/errata/RHSA-2009-1200.html
https://rhn.redhat.com/errata/RHSA-2009-1201.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html	Vendor Advisory
http://java.sun.com/javase/6/webnotes/6u15.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://secunia.com/advisories/36162	Vendor Advisory
http://secunia.com/advisories/36176	Vendor Advisory
http://secunia.com/advisories/36180	Vendor Advisory
http://secunia.com/advisories/36199	Vendor Advisory
http://secunia.com/advisories/37386
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1	PatchVendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1	Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
http://www.vupen.com/english/advisories/2009/2543
https://bugzilla.redhat.com/show_bug.cgi?id=513215
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10221
https://rhn.redhat.com/errata/RHSA-2009-1199.html
https://rhn.redhat.com/errata/RHSA-2009-1200.html
https://rhn.redhat.com/errata/RHSA-2009-1201.html

Track CVE-2009-2475 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2009-2721Sun java se vulnerabilityMultiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406…EPSS 2.4%10 Aug 2009 10.0CVE-2009-2722Sun java se vulnerabilityMultiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429…EPSS 2.8%10 Aug 2009 10.0CVE-2009-2723Sun java se vulnerabilityUnspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka Bug…EPSS 2.7%10 Aug 2009 10.0CVE-2009-2476Sun java se permissions and access controls vulnerabilityThe Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which …EPSS 2.9%10 Aug 2009 10.0CVE-2009-2689Sun java se permissions and access controls vulnerabilityJDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecifie…EPSS 2.8%10 Aug 2009 10.0CVE-2009-1896Sun openjdk permissions and access controls vulnerabilityThe Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an en…EPSS 3.0%10 Aug 2009 9.3CVE-2009-2724Sun java se race condition vulnerabilityRace condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in…EPSS 1.6%10 Aug 2009 9.3CVE-2009-0723Gimp integer overflow vulnerabilityMultiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependen…EPSS 5.0%23 Mar 2009

Source: NIST National Vulnerability Database (record CVE-2009-2475), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.