CVE-2009-3871

Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via crafted arguments, aka Bug Id 6872358.

• CWE-119

• http://java.sun.com/javase/6/webnotes/6u17.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
• http://marc.info/?l=bugtraq&m=126566824131534&w=2
• http://marc.info/?l=bugtraq&m=131593453929393&w=2
• http://marc.info/?l=bugtraq&m=134254866602253&w=2
• http://secunia.com/advisories/37231Vendor Advisory
• http://secunia.com/advisories/37239
• http://secunia.com/advisories/37386
• http://secunia.com/advisories/37581
• http://secunia.com/advisories/37841
• http://security.gentoo.org/glsa/glsa-200911-02.xml
• http://securitytracker.com/id?1023132
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1Patch, Vendor Advisory
• http://support.apple.com/kb/HT3969
• http://support.apple.com/kb/HT3970
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
• http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
• http://www.redhat.com/support/errata/RHSA-2009-1694.html
• http://www.securityfocus.com/bid/36881
• http://www.vupen.com/english/advisories/2009/3131Patch, Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-09-079/Patch
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12134
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6698
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8275
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9360
• http://java.sun.com/javase/6/webnotes/6u17.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
• http://marc.info/?l=bugtraq&m=126566824131534&w=2
• http://marc.info/?l=bugtraq&m=131593453929393&w=2
• http://marc.info/?l=bugtraq&m=134254866602253&w=2
• http://secunia.com/advisories/37231Vendor Advisory
• http://secunia.com/advisories/37239
• http://secunia.com/advisories/37386
• http://secunia.com/advisories/37581
• http://secunia.com/advisories/37841
• http://security.gentoo.org/glsa/glsa-200911-02.xml
• http://securitytracker.com/id?1023132
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1Patch, Vendor Advisory
• http://support.apple.com/kb/HT3969
• http://support.apple.com/kb/HT3970
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
• http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
• http://www.redhat.com/support/errata/RHSA-2009-1694.html
• http://www.securityfocus.com/bid/36881
• http://www.vupen.com/english/advisories/2009/3131Patch, Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-09-079/Patch
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12134
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6698
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8275
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9360

Published

Nov 5, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3865The launch method in the Deployment Toolkit plugin in Java R…
• CVE-2009-3866The Java Web Start Installer in Sun Java SE in JDK and JRE 6…
• CVE-2009-3867Stack-based buffer overflow in the HsbParser.getSoundBank fu…
• CVE-2009-3868Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE…
• CVE-2009-3869Stack-based buffer overflow in the setDiffICM function in th…
• CVE-2009-3870Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2009-3872Unspecified vulnerability in the JPEG JFIF Decoder in Sun Ja…
• CVE-2009-3873The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 befo…
• CVE-2009-3874Integer overflow in the JPEGImageReader implementation in th…
• CVE-2009-3875The MessageDigest.isEqual function in Java Runtime Environme…
• CVE-2009-3876Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 …
• CVE-2009-3877Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 …