CVE-2009-2475
Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context...
Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.
Exploit likelihood
What each source reports
NVD Score used
Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.
- Record
CVE-2009-2475- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:C/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.
- Record
CVE-2009-2475- Updated
- 2026-11-02
EUVDEUVD-2009-2470 No score
Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.
- Record
EUVD-2009-2470- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2vx8-fp5p-f94q No score
Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context...
Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.
- Record
GHSA-2vx8-fp5p-f94q- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.5.0-sunRed Hat:rhel_extras:4 |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sun-demoRed Hat:rhel_extras:4 |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sun-develRed Hat:rhel_extras:4 |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:4 |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:4 |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sun-srcRed Hat:rhel_extras:4 |
before 0:1.5.0.20-1jpp.1.el4 | 0:1.5.0.20-1jpp.1.el4 |
java-1.5.0-sunRed Hat:rhel_extras:5::client |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::client |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::client |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::client |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
Show 40 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::client |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::client |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sunRed Hat:rhel_extras:5::server |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::server |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::server |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::server |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::server |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::server |
before 0:1.5.0.20-1jpp.1.el5 | 0:1.5.0.20-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:4 |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sun-demoRed Hat:rhel_extras:4 |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sun-develRed Hat:rhel_extras:4 |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:4 |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:4 |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sun-srcRed Hat:rhel_extras:4 |
before 1:1.6.0.15-1jpp.1.el4 | 1:1.6.0.15-1jpp.1.el4 |
java-1.6.0-sunRed Hat:rhel_extras:5::client |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::client |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::client |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::client |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::client |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::client |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:5::server |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::server |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::server |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::server |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::server |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::server |
before 1:1.6.0.15-1jpp.1.el5 | 1:1.6.0.15-1jpp.1.el5 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.2.b09.el5 | 1:1.6.0.0-1.2.b09.el5 |
java-1.5.0-sunRed Hat:network_satellite:5.1::el4 |
before 0:1.5.0.22-1jpp.1.el4 | 0:1.5.0.22-1jpp.1.el4 |
java-1.5.0-sun-develRed Hat:network_satellite:5.1::el4 |
before 0:1.5.0.22-1jpp.1.el4 | 0:1.5.0.22-1jpp.1.el4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2475 is a high vulnerability (CVSS 7.8) in Sun Java Se, published August 10, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.32%, the 83rd percentile. Fixed in java-1.5.0-sun 0:1.5.0.20-1jpp.1.el4.
References
rhn.redhat.com/errata/RHSA-2009-1200.html
bugzilla.redhat.com/show_bug.cgi?id=513215
secunia.com/advisories/36162
vupen.com/english/advisories/2009/2543
security.gentoo.org/glsa/glsa-200911-02.xml
Show 194 moreShow less
sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1
mandriva.com/security/advisories?name=MDVSA-2009:209
redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
java.sun.com/javase/6/webnotes/6u15.html
lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10221
lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
nvd.nist.gov/vuln/detail/CVE-2009-2475
github.com/advisories/GHSA-2vx8-fp5p-f94q
access.redhat.com/errata/RHSA-2009:1199
blogs.sun.com/security/entry/advance_notification_of_security_updates5
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1199.json
cve.org/CVERecord?id=CVE-2009-2475
Left out here: 5 references. The JSON record has them.