CVE-2009-3869

Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.

• CWE-119

• https://java.sun.com/javase/6/webnotes/6u17.htmlVendor Advisory
• https://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
• https://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
• https://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
• https://marc.info/?l=bugtraq&m=126566824131534&w=2
• https://marc.info/?l=bugtraq&m=131593453929393&w=2
• https://marc.info/?l=bugtraq&m=134254866602253&w=2
• https://secunia.com/advisories/37231Vendor Advisory
• https://secunia.com/advisories/37239
• https://secunia.com/advisories/37386
• https://secunia.com/advisories/37581
• https://secunia.com/advisories/37841
• https://security.gentoo.org/glsa/glsa-200911-02.xml
• https://securitytracker.com/id?1023132
• https://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1Patch, Vendor Advisory
• https://support.apple.com/kb/HT3969
• https://support.apple.com/kb/HT3970
• https://www.mandriva.com/security/advisories?name=MDVSA-2010:084
• https://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
• https://www.redhat.com/support/errata/RHSA-2009-1694.html
• https://www.securityfocus.com/bid/36881
• https://www.vupen.com/english/advisories/2009/3131Patch, Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-09-078/Patch
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10741
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11262
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7400
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8566
• https://java.sun.com/javase/6/webnotes/6u17.htmlVendor Advisory
• https://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
• https://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
• https://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
• https://marc.info/?l=bugtraq&m=126566824131534&w=2
• https://marc.info/?l=bugtraq&m=131593453929393&w=2
• https://marc.info/?l=bugtraq&m=134254866602253&w=2
• https://secunia.com/advisories/37231Vendor Advisory
• https://secunia.com/advisories/37239
• https://secunia.com/advisories/37386
• https://secunia.com/advisories/37581
• https://secunia.com/advisories/37841
• https://security.gentoo.org/glsa/glsa-200911-02.xml
• https://securitytracker.com/id?1023132
• https://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1Patch, Vendor Advisory
• https://support.apple.com/kb/HT3969
• https://support.apple.com/kb/HT3970
• https://www.mandriva.com/security/advisories?name=MDVSA-2010:084
• https://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
• https://www.redhat.com/support/errata/RHSA-2009-1694.html
• https://www.securityfocus.com/bid/36881
• https://www.vupen.com/english/advisories/2009/3131Patch, Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-09-078/Patch
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10741
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11262
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7400
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8566

Published

Nov 5, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3863Buffer overflow in the gxmim1.dll ActiveX control in Novell …
• CVE-2009-3864The Java Update functionality in Java Runtime Environment (J…
• CVE-2009-3865The launch method in the Deployment Toolkit plugin in Java R…
• CVE-2009-3866The Java Web Start Installer in Sun Java SE in JDK and JRE 6…
• CVE-2009-3867Stack-based buffer overflow in the HsbParser.getSoundBank fu…
• CVE-2009-3868Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE…
• CVE-2009-3870Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2009-3871Heap-based buffer overflow in the setBytePixels function in …
• CVE-2009-3872Unspecified vulnerability in the JPEG JFIF Decoder in Sun Ja…
• CVE-2009-3873The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 befo…
• CVE-2009-3874Integer overflow in the JPEGImageReader implementation in th…
• CVE-2009-3875The MessageDigest.isEqual function in Java Runtime Environme…