CVE-2007-2435 Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that gra...
HighCVSS 10.0
EPSS 5.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun java enterprise system | <= 5.0 | No fix listed |
| sun jre | <= 1.4.2 | No fix listed |
| sun jre | <= 1.5.0 | No fix listed |
| sun sdk | <= 1.4.3_13 | No fix listed |
References
- BEA07-173.00 vendor-advisory
- docs.info.apple.com
- APPLE-SA-2007-12-14 vendor-advisory
- 35483 vdb-entry
- 25069 patch third-party-advisory vendor-advisory
- 25283 third-party-advisory
- 25413 third-party-advisory
- 25474 third-party-advisory
- 25832 third-party-advisory
- 26311 third-party-advisory
- 26369 third-party-advisory
- 28115 third-party-advisory
- 29858 third-party-advisory
- 30780 third-party-advisory
- GLSA-200706-08 vendor-advisory
- GLSA-200804-28 vendor-advisory
- 102881 patch vendor-advisory
- support.avaya.com
- GLSA-200705-23 vendor-advisory
- GLSA-200804-20 vendor-advisory
- GLSA-200806-11 vendor-advisory
- RHSA-2007:0817 vendor-advisory
- RHSA-2007:0829 vendor-advisory
- RHSA-2008:0261 vendor-advisory
- 23728 patch vdb-entry
- 1017986 vdb-entry
- ADV-2007-1598 vdb-entry
- ADV-2007-1814 vdb-entry
- ADV-2007-4224 vdb-entry
- javawebstart-classes-privilege-escalation(33984) vdb-entry
- oval:org.mitre.oval:def:10999 signature vdb-entry