CVE-2009-1719
Status: ModifiedHigh (7.5)—
The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to the undocumented apple.laf.CColourUIResource constructor with a crafted value in the first argument, which is dereferenced as a pointer.
CVSS
- Version: 2.0
- Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
- Base score: 7.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 5.12%
- Percentile among all scored CVEs: 92
- Score date: 10/12/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-94
References
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00003.html
- http://support.apple.com/kb/HT3632
- http://www.securityfocus.com/archive/1/504364/100/0/threaded
- http://www.securityfocus.com/bid/35381
- http://www.securityfocus.com/bid/35401
- http://www.zerodayinitiative.com/advisories/ZDI-09-043
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51185
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00003.html
- http://support.apple.com/kb/HT3632
- http://www.securityfocus.com/archive/1/504364/100/0/threaded
- http://www.securityfocus.com/bid/35381
- http://www.securityfocus.com/bid/35401
- http://www.zerodayinitiative.com/advisories/ZDI-09-043
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51185
Raw JSON (NVD)
Show
{
"id": "CVE-2009-1719",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-06-16T23:30:00.233",
"references": [
{
"url": "http://lists.apple.com/archives/security-announce/2009/Jun/msg00003.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://support.apple.com/kb/HT3632",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/504364/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/35381",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/35401",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.zerodayinitiative.com/advisories/ZDI-09-043",
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51185",
"source": "cve@mitre.org"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/Jun/msg00003.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://support.apple.com/kb/HT3632",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/504364/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/35381",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/35401",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.zerodayinitiative.com/advisories/ZDI-09-043",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51185",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to the undocumented apple.laf.CColourUIResource constructor with a crafted value in the first argument, which is dereferenced as a pointer."
},
{
"lang": "es",
"value": "Aqua Look and Feel para la implementación de Java en Java v1.5 en Mac OS X 10.5 permite a atacantes remotos ejecutar código arbitrario a través de una llamada a los indocumentados.\r\nEl constructor apple.laf.CColourUIResource con un valor manipulado en el primer argumento, lo que permite desreferenciar como puntero."
}
],
"lastModified": "2026-06-16T23:07:54.643",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:mac_os_x:10.5.6:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AA12DDA2-6B31-4BB2-BDAC-8DDB7726491D"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.5:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D2442D35-7484-43D8-9077-3FDF63104816"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.5.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DC90AA12-DD17-4607-90CB-E342E83F20BB"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.5.1:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3F3E721C-00CA-4D51-B542-F2BC5C0D65BF"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.5.2:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B3267A41-1AE0-48B8-BD1F-DEC8A212851A"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.5.2:2008-002:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0DA315DB-10DF-4D18-A575-37A70F9AFD3F"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.5.3:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "855288F1-0242-4951-AB3F-B7AF13E21CF6"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.5.4:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "10082781-B93E-4B84-94F2-FA9749B4D92B"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.5.5:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AE1EBF04-C440-4A6B-93F2-DC3A812728C2"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.5.6:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DFB077A2-927B-43AF-BFD5-0E78648C9394"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.5.7:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2398ADC8-A106-462E-B9AE-F8AF800D0A3C"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.5:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "20E8648C-5469-4280-A581-D4A9A41B7213"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.5.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C7817232-BE3E-4655-8282-A979E5D40D3D"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "77E8D614-E1EE-42F1-9E55-EA54FB500621"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C73BED9E-29FB-4965-B38F-013FFE5A9170"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.5.3:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D3B7DEC3-1C0B-4D13-98CD-CB7FAE7933B0"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.5.4:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7723A9E8-1DE2-4C7D-81E6-4F79DCB09324"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.5.5:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C147E866-B80F-4FFA-BBE8-19E84A46DB1C"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.5.6:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8EC681A4-6F58-4C7D-B4E0-FCC1BCBC534E"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.5.7:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "ADF94705-562C-4EC8-993E-1AD88F01549C"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "133A7B66-E0B3-4867-A5A4-3C54D6C0C8ED"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7FC09E8-7F30-4FE4-912E-588AA250E2A3"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A586DE4E-8A46-41DE-9FDB-5FDB81DCC87B"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9919D091-73D7-465A-80FF-F37D6CAF9F46"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "02565D6F-4CB2-4671-A4EF-3169BCFA6154"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "452A3E51-9EAC-451D-BA04-A1E7B7D917EB"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E8C6AAC-C90B-4220-A69B-2A886A35CF5D"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55231B6B-9298-4363-9B5A-14C2DA7B1F50"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E42CF0F7-418C-4BB6-9B73-FA3B9171D092"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5467E9D-07D8-4BEB-84D5-A3136C133519"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7EA5B9E9-654D-44F7-AE98-3D8B382804AC"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "44051CFE-D15D-4416-A123-F3E49C67A9E7"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F296ACF3-1373-429D-B991-8B5BA704A7EF"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B863420B-DE16-416A-9640-1A1340A9B855"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "724C972F-74FE-4044-BBC4-7E0E61FC9002"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46F41C15-0EF4-4115-BFAA-EEAD56FAEEDB"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EBE909DE-E55A-4BD3-A5BF-ADE407432193"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5DAC04D2-68FD-4793-A8E7-4690A543D7D4"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.5.0_11-b03:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69FBB4CC-566A-450B-8A93-4755019F9EC0"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}