← Vulnerability feed

Vulnerability record · CVE-2009-2689 · published 10 August 2009

CVE-2009-2689: Sun java se permissions and access controls vulnerability

Sun · Java Se

JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.

10.0 CVSS 2.0 High EPSS 2.8% · top 13.9% CWE-264 · Permissions and access controls
10.0CVSS 2.0 base score
2.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
38References
16 Jun 2026Last modified by NVD

Description

JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html Patch
http://java.sun.com/javase/6/webnotes/6u15.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://secunia.com/advisories/36162 Vendor Advisory
http://secunia.com/advisories/36180 Vendor Advisory
http://secunia.com/advisories/36199 Vendor Advisory
http://secunia.com/advisories/37386
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1 Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1 Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
http://www.vupen.com/english/advisories/2009/2543
https://bugzilla.redhat.com/show_bug.cgi?id=513222
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9603
https://rhn.redhat.com/errata/RHSA-2009-1199.html
https://rhn.redhat.com/errata/RHSA-2009-1201.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html Patch
http://java.sun.com/javase/6/webnotes/6u15.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://secunia.com/advisories/36162 Vendor Advisory
http://secunia.com/advisories/36180 Vendor Advisory
http://secunia.com/advisories/36199 Vendor Advisory
http://secunia.com/advisories/37386
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1 Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1 Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
http://www.vupen.com/english/advisories/2009/2543
https://bugzilla.redhat.com/show_bug.cgi?id=513222
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9603
https://rhn.redhat.com/errata/RHSA-2009-1199.html
https://rhn.redhat.com/errata/RHSA-2009-1201.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html

Track CVE-2009-2689 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2009-2721Sun java se vulnerabilityMultiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406…EPSS 2.4%10.0CVE-2009-2722Sun java se vulnerabilityMultiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429…EPSS 2.8%10.0CVE-2009-2723Sun java se vulnerabilityUnspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka Bug…EPSS 2.7%10.0CVE-2009-2476Sun java se permissions and access controls vulnerabilityThe Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which …EPSS 2.9%10.0CVE-2009-1896Sun openjdk permissions and access controls vulnerabilityThe Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an en…EPSS 3.0%9.3CVE-2009-2724Sun java se race condition vulnerabilityRace condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in…EPSS 1.6%9.3CVE-2009-0723Gimp integer overflow vulnerabilityMultiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependen…EPSS 5.0%9.3CVE-2009-0733Gimp out-of-bounds write vulnerabilityMultiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta…EPSS 5.5%

Source: NIST National Vulnerability Database (record CVE-2009-2689), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.