CVE-2009-3865
Status: ModifiedHigh (9.3)—
The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
- Base score: 9.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 9.40%
- Percentile among all scored CVEs: 95
- Score date: 10/12/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-94
References
- http://java.sun.com/javase/6/webnotes/6u17.html
- http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
- http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://secunia.com/advisories/37231
- http://secunia.com/advisories/37239
- http://secunia.com/advisories/37386
- http://secunia.com/advisories/37581
- http://secunia.com/advisories/37841
- http://security.gentoo.org/glsa/glsa-200911-02.xml
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-269869-1
- http://support.apple.com/kb/HT3969
- http://support.apple.com/kb/HT3970
- http://www.redhat.com/support/errata/RHSA-2009-1694.html
- http://www.securityfocus.com/bid/36881
- http://www.securitytracker.com/id?1023244
- http://www.vupen.com/english/advisories/2009/3131
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7562
- http://java.sun.com/javase/6/webnotes/6u17.html
- http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
- http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://secunia.com/advisories/37231
- http://secunia.com/advisories/37239
- http://secunia.com/advisories/37386
- http://secunia.com/advisories/37581
- http://secunia.com/advisories/37841
- http://security.gentoo.org/glsa/glsa-200911-02.xml
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-269869-1
- http://support.apple.com/kb/HT3969
- http://support.apple.com/kb/HT3970
- http://www.redhat.com/support/errata/RHSA-2009-1694.html
- http://www.securityfocus.com/bid/36881
- http://www.securitytracker.com/id?1023244
- http://www.vupen.com/english/advisories/2009/3131
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7562
Raw JSON (NVD)
Show
{
"id": "CVE-2009-3865",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-11-05T16:30:00.280",
"references": [
{
"url": "http://java.sun.com/javase/6/webnotes/6u17.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html",
"source": "cve@mitre.org"
},
{
"url": "http://marc.info/?l=bugtraq&m=134254866602253&w=2",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/37231",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/37239",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/37386",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/37581",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/37841",
"source": "cve@mitre.org"
},
{
"url": "http://security.gentoo.org/glsa/glsa-200911-02.xml",
"source": "cve@mitre.org"
},
{
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269869-1",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://support.apple.com/kb/HT3969",
"source": "cve@mitre.org"
},
{
"url": "http://support.apple.com/kb/HT3970",
"source": "cve@mitre.org"
},
{
"url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/36881",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id?1023244",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2009/3131",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7562",
"source": "cve@mitre.org"
},
{
"url": "http://java.sun.com/javase/6/webnotes/6u17.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://marc.info/?l=bugtraq&m=134254866602253&w=2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/37231",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/37239",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/37386",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/37581",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/37841",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://security.gentoo.org/glsa/glsa-200911-02.xml",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269869-1",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://support.apple.com/kb/HT3969",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://support.apple.com/kb/HT3970",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/36881",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1023244",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/3131",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7562",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752."
},
{
"lang": "es",
"value": "El método launch en el plugin Deployment Toolkit en Java Runtime Environment (JRE) en Sun Java SE en JDK y JRE 6 anteriores a Update 17 permite a los atacantes remotos ejecutar arbitrariamente comandos a través de una página web manipulada, también conocido como Bug Id 6869752."
}
],
"lastModified": "2026-06-16T23:12:30.230",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD30DAEB-4893-41CF-A455-B69C463B9337"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21D6CE7E-A036-496C-8E08-A87F62B5290A"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FE5F6E90-A942-4468-B763-9606CE073A9E"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B0ADF941-5E90-498D-A2E2-7DBCF5358D64"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0819F015-FF7B-4C8F-B195-4CB54070BAE4"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5CB2234-B196-4F41-9FE9-A1896A57E575"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "572A693C-1EEE-4A6C-BA42-B4FB4B28D0FA"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A59AF0A-5335-4650-88DB-5B261FE5E308"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B955A34-DCD3-42E2-BC37-88F348EE31F4"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8F93BBE-1E8C-4EB3-BCC7-20AB2D813F98"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A819CA7F-6AA9-4CB0-8577-7F8C751825DF"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "374CA7F2-A5CE-43A3-8317-EEC605127B98"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0FF2748E-1A9A-4988-91B7-A3A8D2B06CB6"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E2868B56-7CFA-4E49-9EDC-8A5E4F9D4861"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8CCADCB6-E972-429E-AAA6-44857094AF9F"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A86AD5C2-32D1-4C85-A643-A7FF7F46B4C7"
},
{
"criteria": "cpe:2.3:a:sun:jdk:1.6.0:update9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F79C6897-18C1-43CF-AA05-C73AD57F01FE"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "09027C19-D442-446F-B7A8-21DB6787CF43"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7158D2C0-E9AC-4CD6-B777-EA7B7A181997"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90EC6C13-4B37-48E5-8199-A702A944D5A6"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6339EF9-97AC-4675-9971-7435A4B31432"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D1626F8-26F4-4EC5-A486-98808372425F"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA1BFE3B-3773-426B-9E69-250249E059C7"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46621D4B-CA2B-4EAC-884E-9CC9486F2F94"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37FED4C9-7501-4DF3-B05E-0B460CBB2D9E"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6958538A-0C2E-460F-A130-70515AFBB6A5"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABB1D4B3-54E6-455D-9238-B185DB012A43"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "360EF765-0C3A-4A13-9DA3-48928BB978E6"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FBE651B3-3320-48E7-BDD5-74D3C609162C"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F435AA3-B716-4B3B-8873-3646E18CA600"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4773DE1C-50EF-4561-B480-74C6BD64D449"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB2B5C85-D6EE-4C0B-9228-A724D6C780C9"
},
{
"criteria": "cpe:2.3:a:sun:jre:1.6.0:update9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "60D59062-997B-44F1-95C6-619823F138A7"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}