Home > Vulnerability Database > CVE-2009-1106

Mend.io Vulnerability Database

CVE-2009-1106

Date: March 25, 2009

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.

Severity Score

6.5

Related Resources (27)

Url: http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1

Url: http://www.vupen.com/english/advisories/2009/3316

Url: http://marc.info/?l=bugtraq&m=124344236532162&w=2

Url: http://secunia.com/advisories/37386

Url: https://rhn.redhat.com/errata/RHSA-2009-1198.html

Url: http://secunia.com/advisories/34496

Url: http://www.securityfocus.com/bid/34240

Url: http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1

Url: http://secunia.com/advisories/36185

Url: http://www.securitytracker.com/id?1021920

Url: http://www.vupen.com/english/advisories/2009/1426

Url: http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm

Url: http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html

Url: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133

Url: http://security.gentoo.org/glsa/glsa-200911-02.xml

Url: http://www.redhat.com/support/errata/RHSA-2009-0392.html

Url: http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2009-1106

Url: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/49459

Url: http://secunia.com/advisories/35156

Url: http://secunia.com/advisories/35255

Url: http://www.securityfocus.com/archive/1/507985/100/0/threaded

Url: http://secunia.com/advisories/37460

Url: http://www.redhat.com/support/errata/RHSA-2009-1038.html

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6619

Url: https://www.mend.io/vulnerability-database/CVE-2009-1106

Severity Score

6.5

Weakness Type (CWE)

Improper Input Validation

CWE-20

CVSS v3.1

Base Score:	6.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	6.4
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2009-1106

Date: March 25, 2009

Severity Score

Related Resources (27)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?