← Vulnerability feed

Vulnerability record · CVE-2009-2690 · published 10 August 2009

CVE-2009-2690: Sun java se permissions and access controls vulnerability

Sun · Java Se

The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.

5.0 CVSS 2.0 Medium EPSS 2.6% · top 15.3% CWE-264 · Permissions and access controls
5.0CVSS 2.0 base score
2.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
34References
16 Jun 2026Last modified by NVD

Description

The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://java.sun.com/javase/6/webnotes/6u15.html Vendor Advisory
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://secunia.com/advisories/36162 Vendor Advisory
http://secunia.com/advisories/36176 Vendor Advisory
http://secunia.com/advisories/36180 Vendor Advisory
http://secunia.com/advisories/37386
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1 Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
http://www.vupen.com/english/advisories/2009/2543
https://bugzilla.redhat.com/show_bug.cgi?id=513223
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9443
https://rhn.redhat.com/errata/RHSA-2009-1200.html
https://rhn.redhat.com/errata/RHSA-2009-1201.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
http://java.sun.com/javase/6/webnotes/6u15.html Vendor Advisory
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://secunia.com/advisories/36162 Vendor Advisory
http://secunia.com/advisories/36176 Vendor Advisory
http://secunia.com/advisories/36180 Vendor Advisory
http://secunia.com/advisories/37386
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1 Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
http://www.vupen.com/english/advisories/2009/2543
https://bugzilla.redhat.com/show_bug.cgi?id=513223
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9443
https://rhn.redhat.com/errata/RHSA-2009-1200.html
https://rhn.redhat.com/errata/RHSA-2009-1201.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html

Track CVE-2009-2690 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2009-2722Sun java se vulnerabilityMultiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429…EPSS 2.8%10.0CVE-2009-2723Sun java se vulnerabilityUnspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka Bug…EPSS 2.7%10.0CVE-2009-2721Sun java se vulnerabilityMultiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406…EPSS 2.4%10.0CVE-2009-2689Sun java se permissions and access controls vulnerabilityJDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecifie…EPSS 2.8%10.0CVE-2009-2476Sun java se permissions and access controls vulnerabilityThe Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which …EPSS 2.9%10.0CVE-2009-1896Sun openjdk permissions and access controls vulnerabilityThe Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an en…EPSS 3.0%9.3CVE-2009-2724Sun java se race condition vulnerabilityRace condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in…EPSS 1.6%9.3CVE-2009-0723Gimp integer overflow vulnerabilityMultiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependen…EPSS 5.0%

Source: NIST National Vulnerability Database (record CVE-2009-2690), CISA KEV, FIRST EPSS (scores of 2026-10-01). This page is refreshed as NVD updates the record.