Unscored severity · published Mar 1, 2005
CVE-2004-1029
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java…
–
CVSS
17%
EPSS
No
On KEV
Description
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.
Exploitation
Is it being used?
Exploit prediction (EPSS)17.0% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Enterprise Firewall · Symantec
8.0; 8.0; 8.0 · source: NVD
GS
Gateway Security 5400 · Symantec
2.0; 2.0.1 · source: NVD
HP
Hp-ux · HP
11.00; 11.11; 11.22; 11.23 · source: NVD
JS
Java Sdk-rte · HP
1.3; 1.4 · source: NVD
JD
Jdk · Sun
1.3.1_01; 1.3.1_01; 1.3.1_01a; 1.3.1_02; 1.3.1_02; 1.3.1_02; +34 more · source: NVD
JR
Jre · Sun
1.3.0; 1.3.0; 1.3.0; 1.3.0; 1.3.0; 1.3.0; +34 more · source: NVD
LI
Linux · Conectiva
10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1029
jouko.iki.fi
http://jouko.iki.fi/adv/javaplugin.html
lists.apple.com
http://lists.apple.com/archives/security-announce/2005/Feb/msg00000.html
rpmfind.net
http://rpmfind.net/linux/RPM/suse/updates/9.3/i386/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.html
Vendor Advisory
http://secunia.com/advisories/13271
Vendor Advisory
http://secunia.com/advisories/29035
securityreason.com
http://securityreason.com/securityalert/61
More from Linux
9.8
CVE-2002-0083
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges
–
CVE-2005-3626
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted…
–
CVE-2005-3625
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams…
–
CVE-2005-3624
The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via…
–
CVE-2005-0207
Unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x allows NFS clients to cause a denial of service via O_DIRECT