6 Update 3 : Security Vulnerabilities

Cpe Name:cpe:/a:sun:jdk:6:update_3

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2009-2675	264	Overflow +Priv	2009-08-05	2012-10-22	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression.
2	CVE-2009-2674	264	Exec Code Overflow	2009-08-05	2012-10-22	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow.
3	CVE-2009-2673	264	Bypass	2009-08-05	2012-10-22	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword.
4	CVE-2009-2672	264		2009-08-05	2012-10-22	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors.
5	CVE-2009-2671			2009-08-05	2012-10-22	5.0	None	Remote	Low	Not required	Partial	None	None
The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors.
6	CVE-2009-2670	264	+Info	2009-08-05	2012-10-22	5.0	None	Remote	Low	Not required	Partial	None	None
The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.
7	CVE-2009-2625	264	DoS	2009-08-06	2012-11-26	5.0	None	Remote	Low	Not required	None	None	Partial
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
8	CVE-2008-5360			2008-12-05	2010-08-21	6.4	None	Remote	Low	Not required	Partial	Partial	None
Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier creates temporary files with predictable file names, which allows attackers to write malicious JAR files via unknown vectors.
9	CVE-2008-5359	119	Exec Code Overflow	2008-12-05	2010-08-21	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code, related to a ConvolveOp operation in the Java AWT library.
10	CVE-2008-5358	119	Exec Code Overflow Mem. Corr.	2008-12-05	2010-08-21	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier might allow remote attackers to execute arbitrary code via a crafted GIF file that triggers memory corruption during display of the splash screen, possibly related to splashscreen.dll.
11	CVE-2008-5357	189	Exec Code Overflow	2008-12-05	2010-08-21	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file, which triggers a heap-based buffer overflow.
12	CVE-2008-5356	119	Exec Code Overflow	2008-12-05	2010-08-21	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file.
13	CVE-2008-5355	287	Exec Code	2008-12-05	2010-08-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The "Java Update" feature for Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the signature of the JRE that is downloaded, which allows remote attackers to execute arbitrary code via DNS man-in-the-middle attacks.
14	CVE-2008-5354	119	Exec Code Overflow	2008-12-05	2010-08-21	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Stack-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows locally-launched and possibly remote untrusted Java applications to execute arbitrary code via a JAR file with a long Main-Class manifest entry.
15	CVE-2008-5353			2008-12-05	2010-08-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
16	CVE-2008-5352	189	Overflow +Priv	2008-12-05	2010-08-21	9.3	Admin	Remote	Medium	Not required	Complete	Complete	Complete
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
17	CVE-2008-5351	264	Bypass	2008-12-05	2010-08-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier accepts UTF-8 encodings that are not the "shortest" form, which makes it easier for attackers to bypass protection mechanisms for other applications that rely on shortest-form UTF-8 encodings.
18	CVE-2008-5350	200	+Info	2008-12-05	2010-08-21	5.0	None	Remote	Low	Not required	Partial	None	None
Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applications and applets to list the contents of the operating user's directory via unknown vectors.
19	CVE-2008-5349		DoS	2008-12-05	2010-08-21	7.1	None	Remote	Medium	Not required	None	None	Complete
Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows remote attackers to cause a denial of service (CPU consumption) via a crafted RSA public key.
20	CVE-2008-5348		DoS	2008-12-05	2010-08-21	7.1	None	Remote	Medium	Not required	None	None	Complete
Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier, when using Kerberos authentication, allows remote attackers to cause a denial of service (OS resource consumption) via unknown vectors.
21	CVE-2008-5347	264	+Priv	2008-12-05	2010-08-21	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Multiple unspecified vulnerabilities in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier allow untrusted applets and applications to gain privileges via vectors related to access to inner classes in the (1) JAX-WS and (2) JAXB packages.
22	CVE-2008-5345			2008-12-05	2010-08-21	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Unspecified vulnerability in Java Runtime Environment (JRE) with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier allows code that is loaded from a local filesystem to read arbitrary files and make unauthorized connections to localhost via unknown vectors.
23	CVE-2008-5344			2008-12-05	2010-08-21	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applets to read arbitrary files and make unauthorized network connections via unknown vectors related to applet classloading, aka 6716217.
24	CVE-2008-5343			2008-12-05	2010-08-21	9.0	None	Remote	Low	Not required	Complete	Partial	Partial
Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR" and CR 6707535.
25	CVE-2008-5342	200	+Info	2008-12-05	2010-08-21	5.0	None	Remote	Low	Not required	Partial	None	None
Unspecified vulnerability in the BasicService for Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted downloaded applications to cause local files to be displayed in the browser of the user of the untrusted application via unknown vectors, aka 6767668.
26	CVE-2008-5341	200	+Info	2008-12-05	2010-08-21	5.0	None	Remote	Low	Not required	Partial	None	None
Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted JWS applications to obtain the pathname of the JWS cache and the application username via unknown vectors, aka CR 6727071.
27	CVE-2008-5340	264	+Priv	2008-12-05	2010-08-21	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to gain privileges to access local files or applications via unknown vectors, aka 6727081.
28	CVE-2008-5339			2008-12-05	2010-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to perform network connections to unauthorized hosts via unknown vectors, aka CR 6727079.
29	CVE-2008-3115	16		2008-07-09	2009-12-19	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Secure Static Versioning in Sun Java JDK and JRE 6 Update 6 and earlier, and 5.0 Update 6 through 15, does not properly prevent execution of applets on older JRE releases, which might allow remote attackers to exploit vulnerabilities in these older releases.
30	CVE-2008-3114	200	+Info	2008-07-09	2012-10-29	5.0	None	Remote	Low	Not required	Partial	None	None
Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.
31	CVE-2008-3112	264	Dir. Trav.	2008-07-09	2012-10-29	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.
32	CVE-2008-3111	119	Overflow +Priv	2008-07-09	2012-10-29	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
33	CVE-2008-3110	264	+Info	2008-07-09	2010-08-21	4.3	None	Remote	Medium	Not required	Partial	None	None
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to obtain sensitive information by using an applet to read information from another applet.
34	CVE-2008-3109	264	+Priv	2008-07-09	2010-08-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
35	CVE-2008-3107	264	+Priv	2008-07-09	2010-08-21	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in the Virtual Machine in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
36	CVE-2008-3106	264		2008-07-09	2012-10-29	4.3	None	Remote	Medium	Not required	Partial	None	None
Unspecified vulnerability in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted (1) application or (2) applet, a different vulnerability than CVE-2008-3105.
37	CVE-2008-3105	264	DoS	2008-07-09	2010-08-21	8.3	None	Remote	Medium	Not required	Partial	Partial	Complete
Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving "processing of XML data" by a trusted application.
38	CVE-2008-3104	264		2008-07-09	2012-10-29	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an applet's outbound connections by connecting to localhost services running on the machine that loaded the applet.
39	CVE-2008-3103	264		2008-07-09	2010-08-21	9.3	Admin	Remote	Medium	Not required	Complete	Complete	Complete
Unspecified vulnerability in the Java Management Extensions (JMX) management agent in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via unspecified vectors.
40	CVE-2008-2086	94	Exec Code File Inclusion	2008-12-04	2010-08-21	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allow remote attackers to execute arbitrary code via a crafted jnlp file that modifies the (1) java.home, (2) java.ext.dirs, or (3) user.home System Properties, aka "Java Web Start File Inclusion" and CR 6694892.
41	CVE-2008-1187	264	DoS Exec Code	2008-03-06	2011-04-07	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Unspecified vulnerability in Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to cause a denial of service (JRE crash) and possibly execute arbitrary code via unknown vectors related to XSLT transforms.

Total number of vulnerabilities : 41 Page : 1 (This Page)