CVE-2009-2676
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and...
6.8 Medium
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
Exploit likelihood
3.65%Down 0.3 points since Feb 4, 2022
What each source reports
NVD Score used
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
- Record
CVE-2009-2676- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
- Record
CVE-2009-2676- Updated
- 2026-11-02
EUVDEUVD-2009-2669 No score
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
- Record
EUVD-2009-2669- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jv8p-9p3v-3h2p No score
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and...
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
- Record
GHSA-jv8p-9p3v-3h2p- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.5.0-sunRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sun-demoRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sun-develRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sun-srcRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sunRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
Show 55 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sunRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sun-demoRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sun-develRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sun-srcRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sunRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el4 | 1:1.6.0.6-1jpp.3.el4 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el4 | 1:1.6.0.6-1jpp.3.el4 |
java-1.6.0-ibm-develRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el4 | 1:1.6.0.6-1jpp.3.el4 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el4 | 1:1.6.0.6-1jpp.3.el4 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el4 | 1:1.6.0.6-1jpp.3.el4 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el4 | 1:1.6.0.6-1jpp.3.el4 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el4 | 1:1.6.0.6-1jpp.3.el4 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.6-1jpp.3.el5 | 1:1.6.0.6-1jpp.3.el5 |
java-1.5.0-sunRed Hat:network_satellite:5.1::el4 From an advisory covering 32 CVEs |
before 0:1.5.0.22-1jpp.1.el4 | 0:1.5.0.22-1jpp.1.el4 |
java-1.5.0-sun-develRed Hat:network_satellite:5.1::el4 From an advisory covering 32 CVEs |
before 0:1.5.0.22-1jpp.1.el4 | 0:1.5.0.22-1jpp.1.el4 |
java-1.6.0-ibmRed Hat:network_satellite:5.3::el4 From an advisory covering 35 CVEs |
before 1:1.6.0.7-1jpp.3.el4 | 1:1.6.0.7-1jpp.3.el4 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.3::el4 From an advisory covering 35 CVEs |
before 1:1.6.0.7-1jpp.3.el4 | 1:1.6.0.7-1jpp.3.el4 |
java-1.6.0-ibmRed Hat:network_satellite:5.3::el5 From an advisory covering 35 CVEs |
before 1:1.6.0.7-1jpp.2.el5 | 1:1.6.0.7-1jpp.2.el5 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.3::el5 From an advisory covering 35 CVEs |
before 1:1.6.0.7-1jpp.2.el5 | 1:1.6.0.7-1jpp.2.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2676 is a medium vulnerability (CVSS 6.8) in Sun Java Se, published August 5, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.65%, the 89th percentile. No source names a fixed version.
References
rhn.redhat.com/errata/RHSA-2009-1200.html
osvdb.org/56789
secunia.com/advisories/37460
securitytracker.com/id?1022657
security.gentoo.org/glsa/glsa-200911-02.xml
Show 194 moreShow less
vmware.com/security/advisories/VMSA-2009-0016.html
marc.info?l=bugtraq&m=125787273209737&w=2
sunsolve.sun.com/search/document.do?assetkey=1-66-263490-1
securityfocus.com/archive/1/507985/100/0/threaded
us-cert.gov/cas/techalerts/TA09-294A.html
oracle.com/technetwork/topics/security/cpuoct2009-096303.html
lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8453
vupen.com/english/advisories/2009/3316
nvd.nist.gov/vuln/detail/CVE-2009-2676
github.com/advisories/GHSA-jv8p-9p3v-3h2p
access.redhat.com/errata/RHSA-2009:1199
blogs.sun.com/security/entry/advance_notification_of_security_updates5
bugzilla.redhat.com/show_bug.cgi?id=512896
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1199.json
cve.org/CVERecord?id=CVE-2009-2475
ibm.com/developerworks/java/jdk/alerts
redhat.com/security/updates/classification
This page doesn't list everything
Left out here: 65 references. The JSON record has them.