CVE-2007-5237

Java Web Start in Sun JDK and JRE 6 Update 2 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read and modify local files via an untrusted application, aka "two vulnerabilities."...

CVE-2007-5239

The CVE-2007-5239 issue affects Sun Java Web Start / JRE components. Affected products include JDK/JRE 6 Update 2 and earlier, JDK/JRE 5.0 Update 12 and earlier, J2SE 1.4.2_15 and earlier, and J2SE 1.3.1_20 and earlier. The root cause is that Java Web Start/applets do not properly enforce access ...

CVE-2007-5236

CVE-2007-5236 affects Sun Java Web Start/JRE/JDK on Windows. The issue is improper enforcement of access restrictions for untrusted applications, enabling a user‑assisted remote attacker to read local files via an untrusted application. Affected products include Sun JDK/JRE 5.0 Update 12 and earl...

CVE-2007-5236

Java Web Start in Sun JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.215 and earlier, on Windows does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read local files via an untrusted application...

CVE-2007-5238

CVE-2007-5238 affects Sun JDK/JRE: Java Web Start in Sun JDK/JRE 6 Update 2 and earlier, JDK/JRE 5.0 Update 12 and earlier, and SDK/JRE 1.4.2_15 and earlier. The vulnerability does not properly enforce access restrictions for untrusted applications, allowing a user‑assisted remote attacker to obt...

CVE-2007-5237

CVE-2007-5237 affects Sun Java Web Start in JDK/JRE 6 Update 2 and earlier. The issue arises from insufficient access restriction enforcement for untrusted applications, enabling user-assisted remote attackers to read and modify local files via an untrusted application. In the provided documents,...

Sun Java JRE / Web Start Multiple Vulnerabilities (103072, 103073, 103078, 103079, 103112)

According to its version number, the Sun Java Runtime Environment JRE and/or Web Start installed on the remote host reportedly is affected by several issues that could be abused to move / copy local files, read or write local files, circumvent network access restrictions, or elevate privileges...

Buffer overflow

Buffer overflow in the Sun Java Web Start ActiveX control in Java Runtime Environment JRE 1.6.0X allows remote attackers to have an unknown impact via a long argument to the dnsResolve isInstalled.dnsResolve method...

CVE-2007-5019

Buffer overflow in the Sun Java Web Start ActiveX control in Java Runtime Environment JRE 1.6.0X allows remote attackers to have an unknown impact via a long argument to the dnsResolve isInstalled.dnsResolve method...

CVE-2007-5019

The CVE-2007-5019 issue is a buffer overflow in the Sun Java Web Start ActiveX control of Java Runtime Environment (JRE) 1.6.0_X. The vulnerability occurs when processing a long argument to dnsResolve (isInstalled.dnsResolve), due to a boundary error in the ActiveX control. Affected component: Su...

javaws vulnerabilities

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...

A buffer overflow vulnerability in Java Web Start URL parsing code

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file...

javaws vulnerabilities

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...

A buffer overflow vulnerability in Java Web Start URL parsing code

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file...

jnlp-overflow.txt

'----------------------------------------------------------------------------------------------- ' Java Web Start Buffer Overflow POC Exploit ' ' FileName: JavaWebStartPOC.VBS ' Contact: ZhenHan.Liuph4nt0m.org ' Date: 2007-07-10 ' Team: http://www.ph4nt0m.org ' Enviroment: Tested on JRE 1.6,...

CVE-2007-3655

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file...

CVE-2007-3655

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file...

CVE-2007-3655

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file...

CVE-2007-3655

CVE-2007-3655 is a stack-based buffer overflow in javaws.exe (Sun Java Web Start) within JRE 5.0 Update 11 and earlier and 6.0 Update 1 and earlier. An attacker could remotely exploit a long codebase attribute in a JNLP file to execute arbitrary code. Red Hat advisories indicate this CVE was addr...

Sun Java Web Start JNLP File Handling Overflow (102996)

There is reportedly a buffer overflow in the Java Web Start utility distributed with the version of Sun Java Runtime Environment JRE installed on the remote host. If an attacker can convince a user on the affected host to open a specially crafted JNLP file, arbitrary code could be executed subjec...