CVE-2009-1099
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0...
7.5 HighFix available
CVE-2009-1099 is a high vulnerability (CVSS 7.5) in Sun Java Runtime Environment, published March 25, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.66%, the 92nd percentile. Fixed in java-1.6.0-sun 1:1.6.0.13-1jpp.1.el4.
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow.
Exploit likelihood
5.66%Down 6.6 points since Feb 4, 2022
What each source reports
NVD Score used
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow.
- Record
CVE-2009-1099- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow.
- Record
CVE-2009-1099- Updated
- 2026-11-02
EUVDEUVD-2009-1100 No score
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow.
- Record
EUVD-2009-1100- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6g46-c364-qcjc No score
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0...
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow.
- Record
GHSA-6g46-c364-qcjc- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-sunRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-demoRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-develRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-srcRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sunRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
Show 78 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.5.0-sunRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sun-demoRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sun-develRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sun-srcRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sunRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sunRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-develRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibmRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-develRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.5.0-sunRed Hat:network_satellite:5.1::el4 |
before 0:1.5.0.22-1jpp.1.el4 | 0:1.5.0.22-1jpp.1.el4 |
java-1.5.0-sun-develRed Hat:network_satellite:5.1::el4 |
before 0:1.5.0.22-1jpp.1.el4 | 0:1.5.0.22-1jpp.1.el4 |
java-1.6.0-ibmRed Hat:network_satellite:5.3::el4 |
before 1:1.6.0.7-1jpp.3.el4 | 1:1.6.0.7-1jpp.3.el4 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.3::el4 |
before 1:1.6.0.7-1jpp.3.el4 | 1:1.6.0.7-1jpp.3.el4 |
java-1.6.0-ibmRed Hat:network_satellite:5.3::el5 |
before 1:1.6.0.7-1jpp.2.el5 | 1:1.6.0.7-1jpp.2.el5 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.3::el5 |
before 1:1.6.0.7-1jpp.2.el5 | 1:1.6.0.7-1jpp.2.el5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5726
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
secunia.com/advisories/35156
Show 194 moreShow less
support.avaya.com/elmodocs2/security/ASA-2009-109.htm
securitytracker.com/id?1021913
security.gentoo.org/glsa/glsa-200911-02.xml
redhat.com/support/errata/RHSA-2009-1038.html
labs.idefense.com/intelligence/vulnerabilities/display.php?id=777
rhn.redhat.com/errata/RHSA-2009-1198.html
vmware.com/security/advisories/VMSA-2009-0016.html
marc.info?l=bugtraq&m=124344236532162&w=2
sunsolve.sun.com/search/document.do?assetkey=1-26-254571-1
vupen.com/english/advisories/2009/1426
securityfocus.com/archive/1/507985/100/0/threaded
oracle.com/technetwork/topics/security/cpujul2009-091332.html
nvd.nist.gov/vuln/detail/CVE-2009-1099
github.com/advisories/GHSA-6g46-c364-qcjc
access.redhat.com/errata/RHSA-2009:0392
bugzilla.redhat.com/show_bug.cgi?id=492312
blogs.sun.com/security/entry/advance_notification_of_security_updates4
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0392.json
cve.org/CVERecord?id=CVE-2006-2426
ibm.com/developerworks/java/jdk/alerts
This page doesn't list everything
Left out here: 40 references. The JSON record has them.