Unrated severityNVD Advisory· Published Mar 25, 2009· Updated Apr 23, 2026
CVE-2009-1106
CVE-2009-1106
Description
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.
Affected products
6cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
25- sunsolve.sun.com/search/document.donvdPatch
- sunsolve.sun.com/search/document.donvdPatchVendor Advisory
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jspnvd
- lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.htmlnvd
- marc.infonvd
- secunia.com/advisories/34496nvd
- secunia.com/advisories/35156nvd
- secunia.com/advisories/35255nvd
- secunia.com/advisories/36185nvd
- secunia.com/advisories/37386nvd
- secunia.com/advisories/37460nvd
- security.gentoo.org/glsa/glsa-200911-02.xmlnvd
- support.avaya.com/elmodocs2/security/ASA-2009-108.htmnvd
- www.redhat.com/support/errata/RHSA-2009-0392.htmlnvd
- www.redhat.com/support/errata/RHSA-2009-1038.htmlnvd
- www.securityfocus.com/archive/1/507985/100/0/threadednvd
- www.securityfocus.com/bid/34240nvd
- www.securitytracker.com/idnvd
- www.vmware.com/security/advisories/VMSA-2009-0016.htmlnvd
- www.vupen.com/english/advisories/2009/1426nvd
- www.vupen.com/english/advisories/2009/3316nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/49459nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6619nvd
- rhn.redhat.com/errata/RHSA-2009-1198.htmlnvd
News mentions
0No linked articles in our index yet.