CVE-2010-0843

CVE-2010-0843 affects Oracle Java SE/Java for Business: Sound component in Java 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27. Root cause described as related to XNewPtr and improper handling of an integer parameter when allocating heap memory in com.sun.media.sound libraries, enabling remot...

CVE-2007-4381

CVE-2007-4381 is a font-parsing vulnerability in Sun JDK/JRE up to specified versions (5.0 Update 9 and earlier; 1.4.2_14 and earlier) that could let an untrusted applet gain the same privileges as the user running the applet, enabling unauthorized actions via an applet. Public advisories from Re...

CVE-2007-5232

CVE-2007-5232 affects Sun JRE/JDK and related runtimes where applet caching enables a DNS rebinding attack that can bypass an applet’s outbound connection protections. Connected OSV entries (RHSA-2007:0963, RHSA-2008:0132, RHSA-2008:0100, RHSA-2008:0156, etc.) indicate Red Hat Java components (in...

CVE-2004-1029

The vulnerability CVE-2004-1029 affects Sun Java Plug-in in JRE 1.4.2_01, 1.4.2_04, and possibly earlier versions, where data transfer between JavaScript and Java applets fails to restrict access. The root cause is improper isolation that allows a remote attacker to use reflection to access priva...

CVE-2006-0616

CVE-2006-0616 : Unspecified vulnerability in Sun Java JDK/JRE 5.0 Update 4 and earlier allows a remote attacker to bypass the Java sandbox and gain privileges through the reflection APIs (the so‑called “fourth issue”). Exploitation details are not provided in the documents, but multiple sources d...

CVE-2006-6731

CVE-2006-6731 describes multiple buffer overflow vulnerabilities in Sun JDK/JRE 5.0 Update 7 and earlier, J2SE 1.4.2_12 and earlier (1.4.x), and JRE/JDK 1.3.1_18 and earlier. The issues affect Java applets’ ability to read, write, or execute local files, with root causes including (1) integer ove...

CVE-2004-2540

CVE-2004-2540 describes a deserialization vulnerability in readObject for Java Runtime Environment (JRE) and Software Development Kit (SDK) versions 1.4.0 through 1.4.2_05. Reported impact is a denial of service where crafted serialized data can cause the JVM to become unresponsive. The known aff...

CVE-2007-3922

CVE-2007-3922 describes an unspecified vulnerability in the Sun JDK/JRE applet class loader that allows a remote attacker to violate the applet’s outbound connection restrictions by connecting to localhost services on the host that loaded the applet. Affected products/versions include Sun JDK/JRE...

CVE-2007-5236

CVE-2007-5236 affects Sun Java Web Start/JRE/JDK on Windows. The issue is improper enforcement of access restrictions for untrusted applications, enabling a user‑assisted remote attacker to read local files via an untrusted application. Affected products include Sun JDK/JRE 5.0 Update 12 and earl...

CVE-2011-0788

CVE-2011-0788 is an Oracle Java SE 6 vulnerability affecting the Java Runtime Environment on Windows, enabling remote execution of confidential/integrity/availability-impacting actions by untrusted Java Web Start applications and applets through Deployment-related vectors. The related connected d...

CVE-2006-6736

CVE-2006-6736 affects Sun JDK/JRE 5.0 Update 6 and earlier, J2SDK/JRE 1.4.2_12 and earlier 1.4.x, and JDK/JRE 1.3.1_18 and earlier. The vulnerability allows an untrusted applet to access data in other applets (two issues). The connected advisories reference fixes in IBM/Sun Java updates and list ...

CVE-2007-5237

CVE-2007-5237 affects Sun Java Web Start in JDK/JRE 6 Update 2 and earlier. The issue arises from insufficient access restriction enforcement for untrusted applications, enabling user-assisted remote attackers to read and modify local files via an untrusted application. In the provided documents,...

CVE-2008-1190

CVE-2008-1190 describes an unspecified Java Web Start vulnerability in Sun JDK/JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier that could allow a remote attacker to gain privileges via an untrusted application. The description notes this is a different issu...

CVE-2008-3115

CVE-2008-3115 affects Sun JDK/JRE 6 Update 6 and earlier, and 5.0 Update 6 through 15, where the JRE/JMX/Web Start components fail to properly prevent execution of applets on older releases. The description jointly states that this may allow remote attackers to exploit vulnerabilities in these ol...

CVE-2010-0850

CVE-2010-0850 is an unspecified vulnerability in the Java 2D component of Oracle Java SE and Java for Business 1.3.1_27. The connected documents confirm the affected software and component (Java 2D) but do not provide a concrete root cause, exploit details, affected versions beyond the product/da...

CVE-2007-3698

The CVE-2007-3698 issue affects the Java Secure Socket Extension (JSSE) in Sun JDK/JRE, including Sun JDK/JRE 6 Update 1 and earlier, JDK/JRE 5.0 Updates 7–11, and SDK/JRE 1.4.2_11–1.4.2_14, where crafted SSL/TLS handshake requests could cause the Java Runtime Environment to stop responding (deni...

CVE-2007-5689

CVE-2007-5689 affects Sun JRE/JDK in multiple lines: JVM in JRE 1.3.x–1.4.x and JDK/JRE 5.x–6.x allows remote code execution or reading/modifying files via applets granted privileges. Connected docs indicate remediation via updated JRE/JDK packages (e.g., JVM/JRE updates to address these issues; ...

CVE-2011-0706

CVE-2011-0706 affects the JNLPClassLoader in IcedTea-Web (used with OpenJDK Runtime Environment 1.6.0). The issue allows remote attackers to gain privileges via vectors related to handling multiple signers and the assignment of an inappropriate security descriptor. The vulnerability is tied to Ic...

CVE-2011-0817

CVE-2011-0817 is an Oracle Java SE 6 Deployment-related vulnerability (affecting Java SE 6 Update 25 and earlier on Windows) that could allow remote untrusted Java Web Start applications and untrusted applets to affect confidentiality, integrity, and availability via unknown vectors. Several thir...

CVE-2011-0866

CVE-2011-0866 is an unspecified vulnerability in the Java Runtime Environment (JRE) that affects Oracle Java SE 6 Update 25 and earlier, Java 5.0 Update 29 and earlier, and 1.4.2_31 and earlier on Windows. It allows remote untrusted Java Web Start applications and untrusted applets to compromise ...

CVE-2005-0471

CVE-2005-0471 affects Sun Java JRE 1.1.x through 1.4.x. The vulnerability arises when the Java runtime writes temporary files with long filenames that become predictable on file systems using 8.3 short names, enabling remote attackers to write arbitrary files to known locations and potentially ex...

CVE-2008-1196

CVE-2008-1196 describes a stack-based buffer overflow in Java Web Start (javaws.exe) that could allow remote code execution via a crafted JNLP file. Affected products/versions in the initial document include Sun JDK/JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and J2SE/JRE 1.4.2_16 and ...

CVE-2012-1695

CVE-2012-1695 refers to an unspecified vulnerability in the Oracle JRockit component within Oracle Fusion Middleware 28.2.2 and earlier and in JDK/JRE 5 and 6 up to 27.7.1 and earlier. The description notes remote impact to confidentiality, integrity, and availability via unknown vectors. Affecte...

CVE-2010-0090

CVE-2010-0090 affects Oracle Java SE and Java for Business 6 Update 18, involving an unspecified vulnerability in the Java Web Start/Plug-in component that can impact integrity and availability via remote access. The connected sources indicate this CVE was addressed in Oracle Java Critical Patch ...

CVE-2008-1192

CVE-2008-1192 concerns the Java Plug-in for Sun JDK/JRE and related SDK/JRE versions (Sun JRE/JDK 6 Update 4 and earlier; 5.0 Update 14 and earlier; 1.4.2_16 and earlier; 1.3.1_21 and earlier) and allows remote attackers to bypass the same origin policy and “execute local applications” via unknow...

CVE-2000-1099

CVE-2000-1099 affects the Java Runtime Environment in JDK 1.2.2_05 and earlier . The vulnerability allows an untrusted Java class to call into a disallowed class, potentially allowing sandbox escape and unauthorized activities. The available documents do not provide a specific patch version or re...

CVE-2002-0058

CVE-2002-0058 describes a vulnerability in the Java Runtime Environment where a web applet could abuse an HTTP proxy to hijack or sniff a client’s session by redirecting traffic to another server. Affected: Netscape 6.x (6.0–6.1) and 4.79 and earlier, and Microsoft VM builds 3802 and earlier (IE ...

CVE-2006-0615

CVE-2006-0615 concerns multiple unspecified vulnerabilities in Sun Java JDK/JRE 5.0 Update 4 and earlier (and 1.4.x through 1.4.2_09) that allow remote attackers to bypass the Java sandbox and obtain privileges via reflection APIs. Affected components include the Java applet/JRE sandbox and Web S...

CVE-2008-1186

CVE-2008-1186: Unspecified privilege-escalation in Sun JRE/JDK 5.0 Update 13 and earlier and J2SDK/JRE 1.4.2_16 and earlier, due to an untrusted application or applet. Remote attackers could gain privileges via such untrusted code. The provided connected documents confirm the vulnerability set in...

CVE-2002-0076

CVE-2002-0076 affects the Java Runtime Environment (JRE) Bytecode Verifier. The verifier flaw allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation. Affected are Microsoft VM builds up to 3802 (Internet Explorer 4.x/5.x) and Net...

CVE-2007-3504

CVE-2007-3504 describes a directory traversal vulnerability in the PersistenceService of Sun Java Web Start (JDK/JRE 5.0 Update 11 and earlier; Java Web Start in SDK/JRE 1.4.2_13 and earlier) on Windows. An application that grants itself file overwrite privileges can cause unauthorized actions, p...

CVE-2001-1480

Affected software: Sun JRE/JDK 1.2–1.3.0_04. Vulnerable component: clipboard access logic in untrusted applets. Root cause/impact: enables untrusted applets to access the system clipboard, potentially exposing or altering clipboard data. Affected products explicitly listed as SUN JRE/JDK versions...

CVE-2008-1189

CVE-2008-1189 is described as a buffer overflow in Java Web Start affecting Sun JDK/JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier. The description indicates remote arbitrary-code execution via unknown vectors, in a different issue from CVE-2008-1188. Conn...

CVE-2007-5239

The CVE-2007-5239 issue affects Sun Java Web Start / JRE components. Affected products include JDK/JRE 6 Update 2 and earlier, JDK/JRE 5.0 Update 12 and earlier, J2SE 1.4.2_15 and earlier, and J2SE 1.3.1_20 and earlier. The root cause is that Java Web Start/applets do not properly enforce access ...

CVE-2003-1123

The vulnerability affects Sun Java Runtime Environment (JRE) and SDK versions 1.4.0_01 and earlier. It allows untrusted applets to access certain information within trusted applets, effectively bypassing the Java security model’s restrictions and enabling information disclosure. No explicit explo...

CVE-2006-6009

CVE-2006-6009 concerns an unspecified information-disclosure vulnerability in the Java Runtime Environment’s Swing library affecting JDK/JRE 5.0 Update 7 and earlier. The issue is described as allowing attackers to obtain certain information via unknown attack vectors, related to an untrusted app...

CVE-2003-1156

CVE-2003-1156 concerns Java Runtime Environment (JRE) and SDK 1.4.2 through 1.4.2_02. A local attacker can cause arbitrary file overwrite via a symbolic link race on (1) unpack.log (created by the unpack program) or (2) .mailcap1 and .mime.types1 (created by the RPM package). The vulnerability is...

CVE-2005-3907

The CVE affects the Sun/Oracle Java Runtime Environment and JDK/JRE 5.0 Update 3 and earlier, where an untrusted Java applet may bypass security restrictions to access system resources and execute arbitrary code remotely. The root cause is an unspecified vulnerability in Java applets that can esc...

CVE-2005-3905

CVE-2005-3905 corresponds to the Java Reflection API vulnerabilities in Sun/Blackdown JDK/JRE prior to the fixed updates, enabling remote code execution by escaping the sandbox via the Reflection API. Affected: Java SDK/JRE 1.3.1_15 and earlier, 1.4.2_08 and earlier, and JDK/JRE 5.0 Update 3 and ...

CVE-2005-3906

CVE-2005-3906 concerns multiple unspecified vulnerabilities in Java reflection APIs that could let remote attackers escape the Java sandbox and access arbitrary files or run arbitrary code. The connected sources specify affected software as Sun/Blackdown JDK/JRE up to 1.4.2_08 (and 1.3.1_15 for C...

CVE-2005-3904

CVE-2005-3904 affects Java JMX in Java JDK/JRE 5.0 Update 3 and later (including 1.4.2+/1.3.1+); a remote attacker could escape the Java sandbox to access files or run arbitrary code. Mitigation from connected sources: upgrade to JDK/JRE 5.0 Update 4, and follow guidance to avoid untrusted applet...

CVE-2009-2030

CVE-2009-2030 concerns an unspecified vulnerability in the XML Digital Signature verification within JVA-RUN on IBM OS/400 i5/OS V5R4M0 and V6R1M0 running JDK 6.0. The initial description provides no concrete impact or vectors; NVD lists a CVSS v2 base score of 10.0 (HIGH) with network access, no...