Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Sun Java SE 6 Update 13 lets attackers run code

CVE-2009-1671 · published 17 years ago
Summary

The Java runtime version 6 Update 13 includes an ActiveX component that can be tricked into running unwanted software when it receives an overly long input. An attacker could use this to install or execute malicious programs on a user’s computer without permission. Update Java to the latest version or apply the vendor’s security patch to close the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sun jre 6
cpe:2.3:a:sun:jre:6:update_13:*:*:*:*:*:*
Original advisory text
Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allow remote attackers to execute arbitrary co...
Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allow remote attackers to execute arbitrary code via a long string argument to the (1) setInstallerType, (2) setAdditionalPackages, (3) compareVersion, (4) getStaticCLSID, or (5) launch method.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
10% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published18 May 2009
Updated16 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-1671 · NVD
Track software like this
Free during beta