Unscored severity · published May 2, 2007
CVE-2007-2435
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an…
–
CVSS
5%
EPSS
No
On KEV
Description
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.0% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Java Enterprise System · Sun
through 5.0 · source: NVD
JR
Jre · Sun
through 1.4.2; through 1.5.0 · source: NVD
SD
Sdk · Sun
through 1.4.3_13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-2435
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-2435
dev2dev.bea.com
http://dev2dev.bea.com/pub/advisory/241
docs.info.apple.com
http://docs.info.apple.com/article.html?artnum=307177
lists.apple.com
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
osvdb.org
http://osvdb.org/35483
Patch
http://secunia.com/advisories/25069
secunia.com
http://secunia.com/advisories/25283
More from Java Enterprise System
–
CVE-2006-3127
Memory leak in Network Security Services (NSS) 3.11, as used in Sun Java Enterprise System 2003Q4 through 2005Q1 and Java System Directory Server 5.2, allows remote attackers to…
–
CVE-2004-0826
Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2…