CVE-2009-2674

Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow.

🔗 References (52)

• cve@mitrehttp://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
• cve@mitrehttp://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html
• cve@mitrehttp://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
• cve@mitrehttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
• cve@mitrehttp://marc.info/?l=bugtraq&m=125787273209737&w=2
• cve@mitrehttp://secunia.com/advisories/36162
• cve@mitrehttp://secunia.com/advisories/36176
• cve@mitrehttp://secunia.com/advisories/36180
• cve@mitrehttp://secunia.com/advisories/36248
• cve@mitrehttp://secunia.com/advisories/37300
• cve@mitrehttp://secunia.com/advisories/37386
• cve@mitrehttp://security.gentoo.org/glsa/glsa-200911-02.xml
• cve@mitrehttp://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1
• cve@mitrehttp://sunsolve.sun.com/search/document.do?assetkey=1-66-263428-1
• cve@mitrehttp://www.mandriva.com/security/advisories?name=MDVSA-2009:209