CVE-2009-2670

The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.

• CWE-264

• http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20
• http://java.sun.com/javase/6/webnotes/6u15.html
• http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
• http://marc.info/?l=bugtraq&m=125787273209737&w=2
• http://osvdb.org/56788
• http://secunia.com/advisories/36162
• http://secunia.com/advisories/36176
• http://secunia.com/advisories/36180
• http://secunia.com/advisories/36199
• http://secunia.com/advisories/36248
• http://secunia.com/advisories/37300
• http://secunia.com/advisories/37386
• http://secunia.com/advisories/37460
• http://security.gentoo.org/glsa/glsa-200911-02.xml
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1Patch, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
• http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
• http://www.securityfocus.com/archive/1/507985/100/0/threaded
• http://www.securityfocus.com/bid/35939
• http://www.securitytracker.com/id?1022658
• http://www.us-cert.gov/cas/techalerts/TA09-294A.htmlUS Government Resource
• http://www.vmware.com/security/advisories/VMSA-2009-0016.html
• http://www.vupen.com/english/advisories/2009/2543
• http://www.vupen.com/english/advisories/2009/3316
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52306
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022
• https://rhn.redhat.com/errata/RHSA-2009-1199.html
• https://rhn.redhat.com/errata/RHSA-2009-1200.html
• https://rhn.redhat.com/errata/RHSA-2009-1201.html
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
• http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20
• http://java.sun.com/javase/6/webnotes/6u15.html
• http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
• http://marc.info/?l=bugtraq&m=125787273209737&w=2
• http://osvdb.org/56788
• http://secunia.com/advisories/36162
• http://secunia.com/advisories/36176
• http://secunia.com/advisories/36180
• http://secunia.com/advisories/36199
• http://secunia.com/advisories/36248
• http://secunia.com/advisories/37300
• http://secunia.com/advisories/37386
• http://secunia.com/advisories/37460
• http://security.gentoo.org/glsa/glsa-200911-02.xml
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1Patch, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
• http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
• http://www.securityfocus.com/archive/1/507985/100/0/threaded
• http://www.securityfocus.com/bid/35939
• http://www.securitytracker.com/id?1022658
• http://www.us-cert.gov/cas/techalerts/TA09-294A.htmlUS Government Resource
• http://www.vmware.com/security/advisories/VMSA-2009-0016.html
• http://www.vupen.com/english/advisories/2009/2543
• http://www.vupen.com/english/advisories/2009/3316
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52306
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022
• https://rhn.redhat.com/errata/RHSA-2009-1199.html
• https://rhn.redhat.com/errata/RHSA-2009-1200.html
• https://rhn.redhat.com/errata/RHSA-2009-1201.html
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html

Published

Aug 5, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2664The js_watch_set function in js/src/jsdbgapi.cpp in the Java…
• CVE-2009-2665The nsDocument::SetScriptGlobalObject function in content/ba…
• CVE-2009-2666socket.c in fetchmail before 6.3.11 does not properly handle…
• CVE-2009-2667Unspecified vulnerability in IBM Tivoli Key Lifecycle Manage…
• CVE-2009-2668Microsoft Internet Explorer 6 through 6.0.2900.2180 and 7 th…
• CVE-2009-2669A certain debugging component in IBM AIX 5.3 and 6.1 does no…
• CVE-2009-2671The SOCKS proxy implementation in Sun Java Runtime Environme…
• CVE-2009-2672The proxy mechanism implementation in Sun Java Runtime Envir…
• CVE-2009-2673The proxy mechanism implementation in Sun Java Runtime Envir…
• CVE-2009-2674Integer overflow in javaws.exe in Sun Java Web Start in Sun …
• CVE-2009-2675Integer overflow in the unpack200 utility in Sun Java Runtim…
• CVE-2009-2676Unspecified vulnerability in JNLPAppletlauncher in Sun Java …