Skip to content
OpenAdvisories
Unscored RHSA-2009:1200 16 CVEs

Red Hat Security Advisory: java-1.6.0-sun security update

Published Sep 29, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 18

ReleasePackageFixed in
Red Hat · RHEL 4 rhel_extras:4 java-1.6.0-sun 1:1.6.0.15-1jpp.1.el4
Red Hat · RHEL 4 rhel_extras:4 java-1.6.0-sun-demo 1:1.6.0.15-1jpp.1.el4
Red Hat · RHEL 4 rhel_extras:4 java-1.6.0-sun-devel 1:1.6.0.15-1jpp.1.el4
Red Hat · RHEL 4 rhel_extras:4 java-1.6.0-sun-jdbc 1:1.6.0.15-1jpp.1.el4
Red Hat · RHEL 4 rhel_extras:4 java-1.6.0-sun-plugin 1:1.6.0.15-1jpp.1.el4
Red Hat · RHEL 4 rhel_extras:4 java-1.6.0-sun-src 1:1.6.0.15-1jpp.1.el4
Red Hat · RHEL 5 rhel_extras:5::client java-1.6.0-sun 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::client java-1.6.0-sun-demo 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::client java-1.6.0-sun-devel 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::client java-1.6.0-sun-jdbc 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::client java-1.6.0-sun-plugin 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::client java-1.6.0-sun-src 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::server java-1.6.0-sun 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::server java-1.6.0-sun-demo 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::server java-1.6.0-sun-devel 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::server java-1.6.0-sun-jdbc 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::server java-1.6.0-sun-plugin 1:1.6.0.15-1jpp.1.el5
Red Hat · RHEL 5 rhel_extras:5::server java-1.6.0-sun-src 1:1.6.0.15-1jpp.1.el5

Vulnerabilities 16

  • Medium —
    CVE-2009-0217

    Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation

    The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server…

    mono org.apache.santuario:xmlsec xml-security-c xmlsec1 Debian Maven
  • Unscored —
    CVE-2009-2475

    Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain…

  • Unscored —
    CVE-2009-2476

    The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly e…

  • Medium —
    CVE-2009-2625 EPSS 30%

    Denial of service in Apache Xerces2

    XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and applic…

    xerces:xercesImpl libxerces2-java Debian Maven
  • Unscored —
    CVE-2009-2670

    The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Up…

  • Unscored —
    CVE-2009-2671

    The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE…

  • Unscored —
    CVE-2009-2672

    The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and…

  • Unscored —
    CVE-2009-2673

    The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and…

  • Unscored —
    CVE-2009-2674

    Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Upda…

  • Unscored —
    CVE-2009-2675

    Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and …

  • Unscored —
    CVE-2009-2676

    Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and ear…

  • Unscored —
    CVE-2009-2690

    The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified na…

  • Unscored —
    CVE-2009-2716

    The plugin functionality in Sun Java SE 6 before Update 15 does not properly implement version selection, which allows …

  • Unscored —
    CVE-2009-2718

    The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on X11 does not impose the intended …

  • Unscored —
    CVE-2009-2719

    The Java Web Start implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denia…

  • Unscored —
    CVE-2009-2720

    Unspecified vulnerability in the javax.swing.plaf.synth.SynthContext.isSubregion method in the Swing implementation in …

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • article
    http://blogs.sun.com/security/entry/advance_notification_of_security_updates5
  • article
    http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=511915
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=512896
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=512907
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=512914
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=512915
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=512920
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=512921
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=513215
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=513220
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=513223
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=515890
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1200.json
  • report
    https://access.redhat.com/security/cve/CVE-2009-0217
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-0217
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-0217
  • report
    https://access.redhat.com/security/cve/CVE-2009-2475
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2475
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2475
  • report
    https://access.redhat.com/security/cve/CVE-2009-2476
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2476
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2476
  • report
    https://access.redhat.com/security/cve/CVE-2009-2625
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2625
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2625
  • report
    https://access.redhat.com/security/cve/CVE-2009-2670
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2670
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2670
  • report
    https://access.redhat.com/security/cve/CVE-2009-2671
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2671
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2671
  • report
    https://access.redhat.com/security/cve/CVE-2009-2672
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2672
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2672
  • report
    https://access.redhat.com/security/cve/CVE-2009-2673
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2673
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2673