Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2007-3655

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.

Published

2007-07-10T19:30:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Primary
CWE-119

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.5.0	Yes
Application	sun	jre	1.6.0	Yes

References

http://docs.info.apple.com/article.html?artnum=307177 ([email protected])
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html ([email protected])
http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064552.html ([email protected])
http://osvdb.org/37756 ([email protected])
http://research.eeye.com/html/advisories/published/AD20070705.html ([email protected])
http://secunia.com/advisories/25981 Vendor Advisory ([email protected])
http://secunia.com/advisories/26314 Vendor Advisory ([email protected])
http://secunia.com/advisories/26369 Vendor Advisory ([email protected])
http://secunia.com/advisories/27266 Vendor Advisory ([email protected])
http://secunia.com/advisories/28115 Vendor Advisory ([email protected])
http://secunia.com/advisories/29858 Vendor Advisory ([email protected])
http://secunia.com/advisories/30780 Vendor Advisory ([email protected])
http://security.gentoo.org/glsa/glsa-200804-28.xml ([email protected])
http://securityreason.com/securityalert/2874 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102996-1 ([email protected])
http://www.exploit-db.com/exploits/30284 ([email protected])
http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml ([email protected])
http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml ([email protected])
http://www.novell.com/linux/security/advisories/2007_56_ibmjava.html ([email protected])
http://www.redhat.com/support/errata/RHSA-2007-0818.html ([email protected])
http://www.redhat.com/support/errata/RHSA-2007-0829.html ([email protected])
http://www.securityfocus.com/archive/1/473224/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/473356/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/24832 Exploit ([email protected])
http://www.securitytracker.com/id?1018346 ([email protected])
http://www.vupen.com/english/advisories/2007/2477 Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2007/4224 Vendor Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/35320 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11367 ([email protected])
http://docs.info.apple.com/article.html?artnum=307177 (af854a3a-2127-422b-91ae-364da2661108)
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064552.html (af854a3a-2127-422b-91ae-364da2661108)
http://osvdb.org/37756 (af854a3a-2127-422b-91ae-364da2661108)
http://research.eeye.com/html/advisories/published/AD20070705.html (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/25981 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/26314 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/26369 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/27266 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/28115 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/29858 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/30780 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-200804-28.xml (af854a3a-2127-422b-91ae-364da2661108)
http://securityreason.com/securityalert/2874 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102996-1 (af854a3a-2127-422b-91ae-364da2661108)
http://www.exploit-db.com/exploits/30284 (af854a3a-2127-422b-91ae-364da2661108)
http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml (af854a3a-2127-422b-91ae-364da2661108)
http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml (af854a3a-2127-422b-91ae-364da2661108)
http://www.novell.com/linux/security/advisories/2007_56_ibmjava.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2007-0818.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2007-0829.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/473224/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/473356/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/24832 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1018346 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/2477 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/4224 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/35320 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11367 (af854a3a-2127-422b-91ae-364da2661108)