CVE-2009-1896
The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed...
Affects 2 products across 2 vendors.
Broad class covering failures in permission enforcement. Deprecated in favor of CWE-284, CWE-862, CWE-863.
This vulnerability was disclosed in 2009. A critical vulnerability affects Fedoraproject systems (CVE-2009-1896). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
BSID: BS-2009-GLOBAL-311908-C • Model: rule-based-v1 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2009-1896?
What is the CVSS score for CVE-2009-1896?
Is CVE-2009-1896 actively exploited?
How do I remediate CVE-2009-1896?
What systems are affected by CVE-2009-1896?
| CVE ID | CVE-2009-1896 |
|---|---|
| BSID | BS-2009-GLOBAL-311908-C BreachSpider Global ID |
| CVSS Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Published | 2009-08-10 |
| Last Modified | 2026-04-23 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.
Source: NIST NVD / MITRE CVE Database
Vulnerability details: The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX. CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C.
Exploitation Likelihood: LOW
| Vendor | Product | Affected Versions |
|---|---|---|
| Sun | Openjdk | ≤ 1.6.0.0 |
Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Fedoraproject Fedora
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | rule-based-v1 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 075521036e98e238516b548f63358e47d391c71d06b902188d4b2e7d60f273caf20ba064b8188979d2bdeb987863ca59f05c499f5714f1d620be36c66599485d |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →