cvelistv5 - cve-2007-3922

CVE-2007-3922 (GCVE-0-2007-3922)

Vulnerability from cvelistv5

Published

2007-07-21 00:00

Modified

2024-08-07 14:37

Severity ?

CWE

Summary

Unspecified vulnerability in the Java Runtime Environment (JRE) Applet Class Loader in Sun JDK and JRE 5.0 Update 11 and earlier, 6 through 6 Update 1, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to violate the security model for an applet's outbound connections by connecting to certain localhost services running on the machine that loaded the applet.

References

URL

Tags

	http://www.redhat.com/support/errata/RHSA-2007-0818.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/26933	third-party-advisory, x_refsource_SECUNIA
	http://docs.info.apple.com/article.html?artnum=307177	x_refsource_MISC
	http://sunsolve.sun.com/search/document.do?assetkey=1-26-102995-1	vendor-advisory, x_refsource_SUNALERT
	http://secunia.com/advisories/26314	third-party-advisory, x_refsource_SECUNIA
	http://dev2dev.bea.com/pub/advisory/248	vendor-advisory, x_refsource_BEA
	http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.486841	vendor-advisory, x_refsource_SLACKWARE
	http://secunia.com/advisories/30805	third-party-advisory, x_refsource_SECUNIA
	http://www.securitytracker.com/id?1018428	vdb-entry, x_refsource_SECTRACK
	http://support.avaya.com/elmodocs2/security/ASA-2007-322.htm	x_refsource_CONFIRM
	http://secunia.com/advisories/26369	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html	vendor-advisory, x_refsource_APPLE
	http://www.vupen.com/english/advisories/2007/2573	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/26645	third-party-advisory, x_refsource_SECUNIA
	https://exchange.xforce.ibmcloud.com/vulnerabilities/35491	vdb-entry, x_refsource_XF
	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450	vendor-advisory, x_refsource_HP
	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450	vendor-advisory, x_refsource_HP
	http://www.vupen.com/english/advisories/2007/4224	vdb-entry, x_refsource_VUPEN
	http://www.vupen.com/english/advisories/2007/3861	vdb-entry, x_refsource_VUPEN
	http://www.vupen.com/english/advisories/2007/3009	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/27266	third-party-advisory, x_refsource_SECUNIA
	http://www.novell.com/linux/security/advisories/2007_56_ibmjava.html	vendor-advisory, x_refsource_SUSE
	http://www.gentoo.org/security/en/glsa/glsa-200709-15.xml	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/25054	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/28115	third-party-advisory, x_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10387	vdb-entry, signature, x_refsource_OVAL
	http://www.redhat.com/support/errata/RHSA-2007-0829.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/26631	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/27635	third-party-advisory, x_refsource_SECUNIA
	http://www.redhat.com/support/errata/RHSA-2008-0133.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:37:05.746Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2007:0818",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2007-0818.html"
          },
          {
            "name": "26933",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26933"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://docs.info.apple.com/article.html?artnum=307177"
          },
          {
            "name": "102995",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102995-1"
          },
          {
            "name": "26314",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26314"
          },
          {
            "name": "BEA07-177.00",
            "tags": [
              "vendor-advisory",
              "x_refsource_BEA",
              "x_transferred"
            ],
            "url": "http://dev2dev.bea.com/pub/advisory/248"
          },
          {
            "name": "SSA:2007-243-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2007\u0026m=slackware-security.486841"
          },
          {
            "name": "30805",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30805"
          },
          {
            "name": "1018428",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018428"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-322.htm"
          },
          {
            "name": "26369",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26369"
          },
          {
            "name": "APPLE-SA-2007-12-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html"
          },
          {
            "name": "ADV-2007-2573",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2573"
          },
          {
            "name": "26645",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26645"
          },
          {
            "name": "sun-java-class-unauthorized-access(35491)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35491"
          },
          {
            "name": "SSRT071465",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450"
          },
          {
            "name": "HPSBMA02288",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450"
          },
          {
            "name": "ADV-2007-4224",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/4224"
          },
          {
            "name": "ADV-2007-3861",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3861"
          },
          {
            "name": "ADV-2007-3009",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3009"
          },
          {
            "name": "27266",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27266"
          },
          {
            "name": "SUSE-SA:2007:056",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2007_56_ibmjava.html"
          },
          {
            "name": "GLSA-200709-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://www.gentoo.org/security/en/glsa/glsa-200709-15.xml"
          },
          {
            "name": "25054",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25054"
          },
          {
            "name": "28115",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28115"
          },
          {
            "name": "oval:org.mitre.oval:def:10387",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10387"
          },
          {
            "name": "RHSA-2007:0829",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2007-0829.html"
          },
          {
            "name": "26631",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26631"
          },
          {
            "name": "27635",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27635"
          },
          {
            "name": "RHSA-2008:0133",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0133.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-07-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Java Runtime Environment (JRE) Applet Class Loader in Sun JDK and JRE 5.0 Update 11 and earlier, 6 through 6 Update 1, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to violate the security model for an applet\u0027s outbound connections by connecting to certain localhost services running on the machine that loaded the applet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2007:0818",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2007-0818.html"
        },
        {
          "name": "26933",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26933"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://docs.info.apple.com/article.html?artnum=307177"
        },
        {
          "name": "102995",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102995-1"
        },
        {
          "name": "26314",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26314"
        },
        {
          "name": "BEA07-177.00",
          "tags": [
            "vendor-advisory",
            "x_refsource_BEA"
          ],
          "url": "http://dev2dev.bea.com/pub/advisory/248"
        },
        {
          "name": "SSA:2007-243-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2007\u0026m=slackware-security.486841"
        },
        {
          "name": "30805",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30805"
        },
        {
          "name": "1018428",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018428"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-322.htm"
        },
        {
          "name": "26369",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26369"
        },
        {
          "name": "APPLE-SA-2007-12-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html"
        },
        {
          "name": "ADV-2007-2573",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2573"
        },
        {
          "name": "26645",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26645"
        },
        {
          "name": "sun-java-class-unauthorized-access(35491)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35491"
        },
        {
          "name": "SSRT071465",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450"
        },
        {
          "name": "HPSBMA02288",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450"
        },
        {
          "name": "ADV-2007-4224",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/4224"
        },
        {
          "name": "ADV-2007-3861",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3861"
        },
        {
          "name": "ADV-2007-3009",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3009"
        },
        {
          "name": "27266",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27266"
        },
        {
          "name": "SUSE-SA:2007:056",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2007_56_ibmjava.html"
        },
        {
          "name": "GLSA-200709-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://www.gentoo.org/security/en/glsa/glsa-200709-15.xml"
        },
        {
          "name": "25054",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25054"
        },
        {
          "name": "28115",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28115"
        },
        {
          "name": "oval:org.mitre.oval:def:10387",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10387"
        },
        {
          "name": "RHSA-2007:0829",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2007-0829.html"
        },
        {
          "name": "26631",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26631"
        },
        {
          "name": "27635",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27635"
        },
        {
          "name": "RHSA-2008:0133",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0133.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-3922",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Java Runtime Environment (JRE) Applet Class Loader in Sun JDK and JRE 5.0 Update 11 and earlier, 6 through 6 Update 1, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to violate the security model for an applet\u0027s outbound connections by connecting to certain localhost services running on the machine that loaded the applet."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2007:0818",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2007-0818.html"
            },
            {
              "name": "26933",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26933"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=307177",
              "refsource": "MISC",
              "url": "http://docs.info.apple.com/article.html?artnum=307177"
            },
            {
              "name": "102995",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102995-1"
            },
            {
              "name": "26314",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26314"
            },
            {
              "name": "BEA07-177.00",
              "refsource": "BEA",
              "url": "http://dev2dev.bea.com/pub/advisory/248"
            },
            {
              "name": "SSA:2007-243-01",
              "refsource": "SLACKWARE",
              "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2007\u0026m=slackware-security.486841"
            },
            {
              "name": "30805",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30805"
            },
            {
              "name": "1018428",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1018428"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2007-322.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-322.htm"
            },
            {
              "name": "26369",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26369"
            },
            {
              "name": "APPLE-SA-2007-12-14",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html"
            },
            {
              "name": "ADV-2007-2573",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2573"
            },
            {
              "name": "26645",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26645"
            },
            {
              "name": "sun-java-class-unauthorized-access(35491)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35491"
            },
            {
              "name": "SSRT071465",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450"
            },
            {
              "name": "HPSBMA02288",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450"
            },
            {
              "name": "ADV-2007-4224",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/4224"
            },
            {
              "name": "ADV-2007-3861",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3861"
            },
            {
              "name": "ADV-2007-3009",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3009"
            },
            {
              "name": "27266",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27266"
            },
            {
              "name": "SUSE-SA:2007:056",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/2007_56_ibmjava.html"
            },
            {
              "name": "GLSA-200709-15",
              "refsource": "GENTOO",
              "url": "http://www.gentoo.org/security/en/glsa/glsa-200709-15.xml"
            },
            {
              "name": "25054",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25054"
            },
            {
              "name": "28115",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/28115"
            },
            {
              "name": "oval:org.mitre.oval:def:10387",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10387"
            },
            {
              "name": "RHSA-2007:0829",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2007-0829.html"
            },
            {
              "name": "26631",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26631"
            },
            {
              "name": "27635",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27635"
            },
            {
              "name": "RHSA-2008:0133",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0133.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-3922",
    "datePublished": "2007-07-21T00:00:00.000Z",
    "dateReserved": "2007-07-20T00:00:00.000Z",
    "dateUpdated": "2024-08-07T14:37:05.746Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2007-AVI-349

Vulnerability from certfr_avis

Une vulnérabilité dans le chargeur d'applet du Java Runtime Environment permet de contourner la politique de sécurité liée à l'exécution d'une applet.

Description

Une vulnérabilité dans le chargeur d'applet du Java Runtime Environment permet à une applet chargée depuis un site distant et qui s'exécute localement d'accéder aux services présents sur la machine sans respecter la politique de sécurité du réseau. Cela permettrait par exemple d'exploiter les vulnérabilités potentielles des services présents sur la machine alors qu'ils ne sont normalement pas accessibles.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

JDK et JRE 6 Update 1;
JDK et JRE 5.0 Update 11;
SDK et JRE 1.4.2_12.

Ainsi que les versions antérieures de ces différentes distributions.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité de Sun 102995 du 18 juillet 2007	None	vendor-advisory
Bulletin de sécurité RedHat RHSA-2007:0818 du 06 août 2007 :	-	other
Bulletin de sécurité Sun Solaris #102995 du 18 juillet 2007 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cUL\u003e    \u003cLI\u003eJDK et JRE 6 Update 1;\u003c/LI\u003e    \u003cLI\u003eJDK et JRE 5.0 Update 11;\u003c/LI\u003e    \u003cLI\u003eSDK et JRE 1.4.2_12.\u003c/LI\u003e  \u003c/UL\u003e  \u003cP\u003eAinsi que les versions ant\u00e9rieures de ces diff\u00e9rentes  distributions.\u003c/P\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 dans le chargeur d\u0027applet du Java Runtime Environment\npermet \u00e0 une applet charg\u00e9e depuis un site distant et qui s\u0027ex\u00e9cute\nlocalement d\u0027acc\u00e9der aux services pr\u00e9sents sur la machine sans respecter\nla politique de s\u00e9curit\u00e9 du r\u00e9seau. Cela permettrait par exemple\nd\u0027exploiter les vuln\u00e9rabilit\u00e9s potentielles des services pr\u00e9sents sur la\nmachine alors qu\u0027ils ne sont normalement pas accessibles.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-3922",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3922"
    }
  ],
  "initial_release_date": "2007-08-07T00:00:00",
  "last_revision_date": "2007-08-07T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2007:0818 du 06 ao\u00fbt 2007    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2007-0818.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Sun Solaris #102995 du 18 juillet 2007    :",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102995-1"
    }
  ],
  "reference": "CERTA-2007-AVI-349",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-08-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans le chargeur d\u0027\u003cspan class=\"textit\"\u003eapplet\u003c/span\u003e\ndu Java Runtime Environment permet de contourner la politique de\ns\u00e9curit\u00e9 li\u00e9e \u00e0 l\u0027ex\u00e9cution d\u0027une \u003cspan class=\"textit\"\u003eapplet\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans la machine virtuelle Java de Sun",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 de Sun 102995 du 18 juillet 2007",
      "url": null
    }
  ]
}

CERTA-2007-AVI-546

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans Java pour Mac OS X.

Description

De multiples vulérabilités de Java pour Mac OS X ont été découvertes. Les vulnérabilités les plus importantes permettent :

un contournement de la politique de sécurité via une appliquette spécialement conçue permettant la suppression et l'insertion d'objets ;
une exécution de code arbitraire à distance et une élévation de privilèges via une vulnérabilité de Java 1.4 ;
une exécution de code arbitraire à distance et une élévation de privilèges via une vulnérabilité de J2SE 5.0.

Solution

Se référer au bulletin de sécurité Apple 307177 pour l'obtention des correctifs (cf. section Documentation).

Mac OS X version 10.4.10 et les versions antérieures.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletins de sécurité Apple 307177 du 12 décembre 2007	None	vendor-advisory
Bulletin de sécurité Apple 307177 du 12 décembre 2007 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eMac OS X version 10.4.10 et les versions ant\u00e9rieures.\u003c/P\u003e",
  "content": "## Description\n\nDe multiples vul\u00e9rabilit\u00e9s de Java pour Mac OS X ont \u00e9t\u00e9 d\u00e9couvertes.\nLes vuln\u00e9rabilit\u00e9s les plus importantes permettent :\n\n-   un contournement de la politique de s\u00e9curit\u00e9 via une appliquette\n    sp\u00e9cialement con\u00e7ue permettant la suppression et l\u0027insertion\n    d\u0027objets ;\n-   une ex\u00e9cution de code arbitraire \u00e0 distance et une \u00e9l\u00e9vation de\n    privil\u00e8ges via une vuln\u00e9rabilit\u00e9 de Java 1.4 ;\n-   une ex\u00e9cution de code arbitraire \u00e0 distance et une \u00e9l\u00e9vation de\n    privil\u00e8ges via une vuln\u00e9rabilit\u00e9 de J2SE 5.0.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 Apple 307177 pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-2788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2788"
    },
    {
      "name": "CVE-2006-4339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4339"
    },
    {
      "name": "CVE-2007-3004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3004"
    },
    {
      "name": "CVE-2007-3698",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3698"
    },
    {
      "name": "CVE-2007-3922",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3922"
    },
    {
      "name": "CVE-2007-0243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0243"
    },
    {
      "name": "CVE-2007-3503",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3503"
    },
    {
      "name": "CVE-2006-6731",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-6731"
    },
    {
      "name": "CVE-2007-3655",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3655"
    },
    {
      "name": "CVE-2007-5862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5862"
    },
    {
      "name": "CVE-2006-6745",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-6745"
    },
    {
      "name": "CVE-2007-4381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4381"
    },
    {
      "name": "CVE-2007-3504",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3504"
    },
    {
      "name": "CVE-2006-6736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-6736"
    },
    {
      "name": "CVE-2007-3005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3005"
    },
    {
      "name": "CVE-2007-2789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2789"
    },
    {
      "name": "CVE-2007-5232",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5232"
    },
    {
      "name": "CVE-2007-2435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2435"
    }
  ],
  "initial_release_date": "2007-12-17T00:00:00",
  "last_revision_date": "2007-12-17T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 307177 du 12 d\u00e9cembre 2007 :",
      "url": "http://docs.info.apple.com/article.html?artnum=307177"
    }
  ],
  "reference": "CERTA-2007-AVI-546",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-12-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Java pour Mac OS X.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple Mac OS X",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 Apple 307177 du 12 d\u00e9cembre 2007",
      "url": null
    }
  ]
}

CERTA-2007-AVI-348

Vulnerability from certfr_avis

Plusieurs vulnérabilités dans les paquetages java-1.4.2-ibm permettent à un utilisateur malveillant de contourner la politique de sécurité du système vulnérable.

Description

Une première vulnérabilité, liée à Java Web Start, permet à un utilisateur d'élever ses privilèges et d'accéder indûment à des fichiers en lecture et en modification (CVE-2007-2435).

Une seconde vulnérabilité permet à une application (ou à une applet) d'élever ses privilèges et d'exécuter un code arbitraire sur la machine virtuelle (CVE-2007-3004).

Une troisième vulnérabilité permet de bloquer la machine virtuelle, provoquant un déni de service (CVE-2007-3005).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
IBM	N/A	Sun Java JDK 1.6.x ;
IBM	N/A	Sun Java JDK 1.5.x ;
IBM	N/A	Sun Java JRE 1.3.x ;
IBM	N/A	Sun Java JRE 1.5.x / 5.x ;
IBM	N/A	Sun Java SDK 1.3.x ;
IBM	N/A	Sun Java JRE 1.4.x ;
IBM	N/A	Sun Java JRE 1.6.x / 6.x ;
IBM	N/A	Sun Java SDK 1.4.x.
IBM	N/A	Sun Java Enterprise System 5.x (JSSE) 1.x ;

References

Title

Publication Time

Tags

Avis Redhat RHSA-2007:0817-2 du 06 août 2007	None	vendor-advisory
Bulletin de sécurité Gentoo GLSA-200705-23 du 31 mai 2007 :	-	other
Bulletin de sécurité Gentoo GLSA-200706-08 du 26 juin 2007 :	-	other
Bulletin de sécurité HP OpenView c01269450 du 14 novembre 2007 :	-	other
Avis du CERTA CERTA-2007-AVI-238 du 01 juin 2007 :	-	other
Bulletin de sécurité Avaya ASA-2007-199 du 23 mai 2007 :	-	other
Bulletin de sécurité SuSE SUSE-SA:2007:045 du 18 juillet 2008 :	-	other
Bulletin de sécurité RedHat RHSA-2007:0829 du 07 août 2007 :	-	other
Bulletin de sécurité RedHat RHSA-2007:0818 du 06 août 2007 :	-	other
Bulletin de sécurité RedHat RHSA-2007:0817 du 06 août 2007 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Sun Java JDK 1.6.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Java JDK 1.5.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Java JRE 1.3.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Java JRE 1.5.x / 5.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Java SDK 1.3.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Java JRE 1.4.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Java JRE 1.6.x / 6.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Java SDK 1.4.x.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Java Enterprise System 5.x (JSSE) 1.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne premi\u00e8re vuln\u00e9rabilit\u00e9, li\u00e9e \u00e0 Java Web Start, permet \u00e0 un\nutilisateur d\u0027\u00e9lever ses privil\u00e8ges et d\u0027acc\u00e9der ind\u00fbment \u00e0 des fichiers\nen lecture et en modification (CVE-2007-2435).\n\nUne seconde vuln\u00e9rabilit\u00e9 permet \u00e0 une application (ou \u00e0 une applet)\nd\u0027\u00e9lever ses privil\u00e8ges et d\u0027ex\u00e9cuter un code arbitraire sur la machine\nvirtuelle (CVE-2007-3004).\n\nUne troisi\u00e8me vuln\u00e9rabilit\u00e9 permet de bloquer la machine virtuelle,\nprovoquant un d\u00e9ni de service (CVE-2007-3005).\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-2788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2788"
    },
    {
      "name": "CVE-2007-3004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3004"
    },
    {
      "name": "CVE-2007-3922",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3922"
    },
    {
      "name": "CVE-2007-3503",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3503"
    },
    {
      "name": "CVE-2007-3655",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3655"
    },
    {
      "name": "CVE-2007-3005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3005"
    },
    {
      "name": "CVE-2007-2789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2789"
    },
    {
      "name": "CVE-2007-2435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2435"
    }
  ],
  "initial_release_date": "2007-08-07T00:00:00",
  "last_revision_date": "2007-11-16T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA-200705-23 du 31 mai 2007 :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200705-23.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA-200706-08 du 26 juin 2007    :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200706-08.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 HP OpenView c01269450 du 14 novembre    2007 :",
      "url": "http://www4.itrc.hp.com/service/cki/docDisplay.do?docId=c01269450"
    },
    {
      "title": "Avis du CERTA CERTA-2007-AVI-238 du 01 juin 2007 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2007-AVI-238/index.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Avaya ASA-2007-199 du 23 mai 2007 :",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-199.htm"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SuSE SUSE-SA:2007:045 du 18 juillet    2008 :",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00007.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2007:0829 du 07 ao\u00fbt 2007    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2007-0829.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2007:0818 du 06 ao\u00fbt 2007    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2007-0818.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2007:0817 du 06 ao\u00fbt 2007    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2007-0817.html"
    }
  ],
  "reference": "CERTA-2007-AVI-348",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-08-07T00:00:00.000000"
    },
    {
      "description": "modification des syst\u00e8mes affect\u00e9s, ajout des r\u00e9f\u00e9rences CVE et des bulletins de s\u00e9curit\u00e9 des \u00e9diteurs SuSE, Red Hat, Avaya et Gentoo.",
      "revision_date": "2007-08-08T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 HP OpenView.",
      "revision_date": "2007-11-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s dans les paquetages java-1.4.2-ibm permettent \u00e0\nun utilisateur malveillant de contourner la politique de s\u00e9curit\u00e9 du\nsyst\u00e8me vuln\u00e9rable.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans la machine Java d\u0027IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis Redhat RHSA-2007:0817-2 du 06 ao\u00fbt 2007",
      "url": null
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2007-3922 (GCVE-0-2007-3922)

Vulnerability from cvelistv5

CERTA-2007-AVI-349

Vulnerability from certfr_avis

Description

Solution

CERTA-2007-AVI-546

Vulnerability from certfr_avis

Description

Solution

CERTA-2007-AVI-348

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature