CVE-2009-1106

N/A Unknown
Published: March 25, 2009 Modified: April 23, 2026
View on NVD

Description

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
Source: cve@mitre.org
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html
Source: cve@mitre.org
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
Source: cve@mitre.org
http://marc.info/?l=bugtraq&m=124344236532162&w=2
Source: cve@mitre.org
http://secunia.com/advisories/34496
Source: cve@mitre.org
http://secunia.com/advisories/35156
Source: cve@mitre.org
http://secunia.com/advisories/35255
Source: cve@mitre.org
http://secunia.com/advisories/36185
Source: cve@mitre.org
http://secunia.com/advisories/37386
Source: cve@mitre.org
http://secunia.com/advisories/37460
Source: cve@mitre.org
http://security.gentoo.org/glsa/glsa-200911-02.xml
Source: cve@mitre.org
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1
Source: cve@mitre.org
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1
Source: cve@mitre.org
Patch Vendor Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm
Source: cve@mitre.org
http://www.redhat.com/support/errata/RHSA-2009-0392.html
Source: cve@mitre.org
http://www.redhat.com/support/errata/RHSA-2009-1038.html
Source: cve@mitre.org
http://www.securityfocus.com/archive/1/507985/100/0/threaded
Source: cve@mitre.org
http://www.securityfocus.com/bid/34240
Source: cve@mitre.org
http://www.securitytracker.com/id?1021920
Source: cve@mitre.org
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
Source: cve@mitre.org
http://www.vupen.com/english/advisories/2009/1426
Source: cve@mitre.org
http://www.vupen.com/english/advisories/2009/3316
Source: cve@mitre.org
https://exchange.xforce.ibmcloud.com/vulnerabilities/49459
Source: cve@mitre.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6619
Source: cve@mitre.org
https://rhn.redhat.com/errata/RHSA-2009-1198.html
Source: cve@mitre.org
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://marc.info/?l=bugtraq&m=124344236532162&w=2
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/34496
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/35156
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/35255
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/36185
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/37386
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/37460
Source: af854a3a-2127-422b-91ae-364da2661108
http://security.gentoo.org/glsa/glsa-200911-02.xml
Source: af854a3a-2127-422b-91ae-364da2661108
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Vendor Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.redhat.com/support/errata/RHSA-2009-0392.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.redhat.com/support/errata/RHSA-2009-1038.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/archive/1/507985/100/0/threaded
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/34240
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securitytracker.com/id?1021920
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.vupen.com/english/advisories/2009/1426
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.vupen.com/english/advisories/2009/3316
Source: af854a3a-2127-422b-91ae-364da2661108
https://exchange.xforce.ibmcloud.com/vulnerabilities/49459
Source: af854a3a-2127-422b-91ae-364da2661108
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6619
Source: af854a3a-2127-422b-91ae-364da2661108
https://rhn.redhat.com/errata/RHSA-2009-1198.html
Source: af854a3a-2127-422b-91ae-364da2661108

50 reference(s) from NVD

Quick Stats

CVSS v3 Score
N/A / 10.0
EPSS (Exploit Probability)
1.4%
80th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-20

Affected Vendors

sun

Related CVEs

CVE-2026-7002 7.3
CVE-2026-7001 2.4
CVE-2026-7000 2.4
CVE-2026-6999 2.4
CVE-2026-6998 2.4