Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2002-0076

Java Runtime Environment (JRE) Bytecode Verifier allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation, as seen in (1) Microsoft VM build 3802 and earlier as used in Internet Explorer 4.x and 5.x, (2) Netscape 6.2.1 and earlier, and possibly other implementations that use vulnerable versions of SDK or JDK, aka a variant of the "Virtual Machine Verifier" vulnerability.

Published

2002-03-19T05:00:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application hp java_jre-jdk 1.1.8 Yes
Application hp java_jre-jdk 1.2.2 Yes
Application hp java_jre-jdk 1.3 Yes
Application microsoft virtual_machine 3802 Yes
Application sun jdk 1.1.8 Yes
Application sun jdk 1.1.8 Yes
Application sun jre 1.1.8 Yes
Application sun jre 1.1.8 Yes
Application sun jre 1.2.2 Yes
Application sun jre 1.3.0 Yes
Application sun jre 1.3.1 Yes
Application sun jre 1.3.1 Yes
Application sun sdk 1.2.2_10 Yes
Application sun sdk 1.2.2_010 Yes
Application sun sdk 1.3.1_01 Yes
Application sun sdk 1.3.1_01a Yes
Application sun sdk 1.3_05 Yes
References