The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade java-1.6.0-openjdkUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk-demoUpgrade java-1.6.0-openjdk-javadoc | Dec 1, 2016 | Aug 10, 2009 |
| Gentoo Linux | — | Upgrade app-emulation/emul-linux-x86-java.Upgrade dev-java/blackdown-jdk.Upgrade dev-java/sun-jdk.Upgrade dev-java/sun-jre-bin.Upgrade dev-java/blackdown-jre. | Oct 30, 2017 | Aug 10, 2009 |
| Oracle_linux | — | Upgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdkUpgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk-demo | Oct 16, 2024 | Aug 10, 2009 |
| Suse | — | Upgrade java-1_6_0-openjdk-demoUpgrade java-1_6_0-sun-develUpgrade java-1_6_0-openjdkUpgrade java-1_6_0-openjdk-develUpgrade java-1_6_0-openjdk-pluginUpgrade java-1_6_0-sun-pluginUpgrade java-1_6_0-sun-jdbcUpgrade java-1_6_0-openjdk-javadocUpgrade java-1_6_0-openjdk-srcUpgrade java-1_6_0-sun-srcUpgrade java-1_6_0-sun-demoUpgrade java-1_6_0-sunUpgrade java-1_6_0-sun-alsa | Feb 17, 2015 | Aug 10, 2009 |
| Ubuntu | — | Upgrade openjdk-6-jre-libUpgrade icedtea6-pluginUpgrade openjdk-6-jre | Nov 8, 2024 | Aug 10, 2009 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub