CVE-2009-3880
Last modified
CVE-2009-3880 is a vulnerability of currently unknown severity. The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager, aka Bug Id 6664512.. EPSS estimates a 1.79% chance of exploitation in the next 30 days.
Description
The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager, aka Bug Id 6664512.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Sun | Jre | <= 1.5.0 | Update 21 |
| Sun | Jre | <= 1.6.0 | Update 16 |
| Sun | Jre | 1.5.0 | Update 1 |
| Sun | Jre | 1.6.0 | Update 1 |
| Sun | Openjdk | All versions | — |
References
- http://java.sun.com/j2se/1.5.0/ReleaseNotes.htmlVendor Advisory
- http://java.sun.com/javase/6/webnotes/6u17.htmlVendor Advisory
- http://java.sun.com/j2se/1.5.0/ReleaseNotes.htmlVendor Advisory
- http://java.sun.com/javase/6/webnotes/6u17.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-3880?
How severe is CVE-2009-3880?
How do I fix CVE-2009-3880?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-3874Integer overflow in the JPEGImageReader implementation in th…
- CVE-2009-3875The MessageDigest.isEqual function in Java Runtime Environme…
- CVE-2009-3876Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 …
- CVE-2009-3877Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 …
- CVE-2009-3878Buffer overflow in Sun Java System Web Server 7.0 Update 6 h…
- CVE-2009-3879Multiple unspecified vulnerabilities in the (1) X11 and (2) …
- CVE-2009-3881Sun Java SE 5.0 before Update 22 and 6 before Update 17, and…
- CVE-2009-3882Multiple unspecified vulnerabilities in the Swing implementa…
- CVE-2009-3883Multiple unspecified vulnerabilities in the Windows Pluggabl…
- CVE-2009-3884The TimeZone.getTimeZone method in Sun Java SE 5.0 before Up…
- CVE-2009-3885Sun Java SE 5.0 before Update 22 and 6 before Update 17 on W…
- CVE-2009-3886The Java Web Start implementation in Sun Java SE 6 before Up…
Are you affected by CVE-2009-3880?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST