CVE-2005-0836 Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06 allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file.
HighCVSS 10.0
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06 allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun j2se | = 1.4.2 | No fix listed |
| sun j2se | = 1.4.2_01 | No fix listed |
| sun j2se | = 1.4.2_02 | No fix listed |
| sun j2se | = 1.4.2_03 | No fix listed |
| sun j2se | = 1.4.2_04 | No fix listed |
| sun j2se | = 1.4.2_05 | No fix listed |
| sun j2se | = 1.4.2_06 | No fix listed |
References
- jouko.iki.fi
- 20050318 Java Web Start argument injection vulnerability mailing-list
- 14640 third-party-advisory vendor-advisory
- 57740 vendor-advisory
- 200255 vendor-advisory
- 1000200 vendor-advisory
- GLSA-200503-28 patch vendor-advisory
- SUSE-SA:2005:032 vendor-advisory
- 12847 patch vdb-entry