CVE-2009-2475

Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.

Published: 2009-08-10 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2009-2475 is rated Moderate Risk (55/100): CVSS High severity, with medium exploitation likelihood (EPSS 0.70%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2009-2475

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-03-30 1.27% 0.70% -0.57%
2 2025-03-29 0.70% 1.27% +0.57%
3 2025-03-19 — 0.70% —

Full EPSS history (7 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2009-2475

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.8 2.0 HIGH
AV:N/AC:L/Au:N/C:C/I:N/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:N)
No availability impact.
 10.0 6.9 [email protected]

Weakness enumeration for CVE-2009-2475

OS Trackers for CVE-2009-2475

vendor priority summary link
gentoo normal CVE-2009-2475: 1 GLSA(s) (200911-02), 5 atom(s) (app-emulation/emul-linux-x86-java, dev-java/blackdown-jdk, dev-java/blackdown-jre, dev-java/sun-jdk, dev-java/sun-jre-bin); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2009-2475
redhat low — https://access.redhat.com/security/cve/CVE-2009-2475
ubuntu medium CVE-2009-2475 medium priority: Ubuntu including 4 source packages (java, openjdk-6, sun-java5, sun-java6), 33 status rows across 9 suites (dapper, gutsy, hardy, intrepid, jaunty, karmic, lucid, maverick, upstream): DNE 12, released 10, ignored 5, not-affected 5, needs-triage 1. https://ubuntu.com/security/CVE-2009-2475

Affected software / configurations for CVE-2009-2475

Vendor Product Version Raw CPE
sun java_se <= 5.0 cpe:2.3:a:sun:java_se:*:20:*:*:*:*:*:*
sun java_se <= 6 cpe:2.3:a:sun:java_se:*:14:*:*:*:*:*:*
sun openjdk — cpe:2.3:a:sun:openjdk:*:*:*:*:*:*:*:*

References for CVE-2009-2475

URL Tags
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html Vendor Advisory
http://java.sun.com/javase/6/webnotes/6u15.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://secunia.com/advisories/36162 Vendor Advisory
http://secunia.com/advisories/36176 Vendor Advisory
http://secunia.com/advisories/36180 Vendor Advisory
http://secunia.com/advisories/36199 Vendor Advisory
http://secunia.com/advisories/37386
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-22-1 Patch Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1 Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
http://www.vupen.com/english/advisories/2009/2543
https://bugzilla.redhat.com/show_bug.cgi?id=513215
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10221
https://rhn.redhat.com/errata/RHSA-2009-1199.html
https://rhn.redhat.com/errata/RHSA-2009-1200.html
https://rhn.redhat.com/errata/RHSA-2009-1201.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
cvelogic Threat Intelligence