← Vulnerability feed

Vulnerability record · CVE-2009-3864 · published 5 November 2009

CVE-2009-3864: Microsoft windows vulnerability

Microsoft · Windows

The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to leverage vulnerabilities in older releases of this software, aka Bug Id 6869694.

7.5 CVSS 2.0 High EPSS 22% · top 2.4%
7.5CVSS 2.0 base score
22%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
16References
16 Jun 2026Last modified by NVD

Description

The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to leverage vulnerabilities in older releases of this software, aka Bug Id 6869694.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://java.sun.com/javase/6/webnotes/6u17.html
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
http://secunia.com/advisories/37231 Vendor Advisory
http://secunia.com/advisories/37239
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269868-1 PatchVendor Advisory
http://www.securityfocus.com/bid/36881 Patch
http://www.vupen.com/english/advisories/2009/3131 PatchVendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6753
http://java.sun.com/javase/6/webnotes/6u17.html
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
http://secunia.com/advisories/37231 Vendor Advisory
http://secunia.com/advisories/37239
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269868-1 PatchVendor Advisory
http://www.securityfocus.com/bid/36881 Patch
http://www.vupen.com/english/advisories/2009/3131 PatchVendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6753

Track CVE-2009-3864 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2013-2465Oracle Java SE JRE 2D sandbox bypass and code executionCVE-2013-2465 is an unspecified vulnerability in the 2D component of Oracle Java SE JRE (7 Update 21 and earlier, 6 Update 45 and earlier, 5.0 Update…KEVEPSS 99%analysed9.8CVE-2012-0507Oracle Java SE JRE AtomicReferenceArray type confusion sandbox bypassCVE-2012-0507 is an unspecified vulnerability in the Java Runtime Environment (JRE) Concurrency component affecting Java SE 7 Update 2 and earlier, 6…KEVEPSS 98%analysed10.0CVE-2015-4716Owncloud path traversal vulnerabilityDirectory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows re…EPSS 25%10.0CVE-2015-3076Adobe acrobat reader memory buffer overflow vulnerabilityAdobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial …EPSS 12%10.0CVE-2015-3074Adobe acrobat improper access control vulnerabilityAdobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScrip…EPSS 9.9%10.0CVE-2015-3075Adobe acrobat use after free vulnerabilityUse-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute …EPSS 9.3%10.0CVE-2015-3073Adobe acrobat improper access control vulnerabilityAdobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScrip…EPSS 25%10.0CVE-2015-3072Adobe acrobat improper access control vulnerabilityAdobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScrip…EPSS 9.9%

Source: NIST National Vulnerability Database (record CVE-2009-3864), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.