PT-2005-4646 · Oracle · Jdk+2

Adam Gowdiak · Published 2005-11-30 · Updated 2018-10-30 · CVE-2005-3906

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java SDK and JRE versions 1.4.2 08 and earlier JDK and JRE 5.0 Update 3 and earlier

Description The issue involves multiple unspecified vulnerabilities in reflection APIs, allowing remote attackers to escape the Java sandbox. This enables access to arbitrary files or execution of arbitrary applications via unknown attack vectors.

Recommendations For Java SDK and JRE versions 1.4.2 08 and earlier, update to a version later than 1.4.2 08 to resolve the issue. For JDK and JRE 5.0 Update 3 and earlier, update to a version later than 5.0 Update 3 to resolve the issue.

Fix

Related Identifiers

CVE-2005-3906

Affected Products

Jdk

Jre

Java Sdk

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2005-3906 · Security Note
• http://vupen.com/english/advisories/2005/2675 · Vendor Advisory
• http://secunia.com/advisories/18503 · Vendor Advisory
• http://vupen.com/english/advisories/2005/2946 · Vendor Advisory
• http://secunia.com/advisories/17847 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2005/Nov/msg00004.html · Vendor Advisory
• http://secunia.com/advisories/18435 · Vendor Advisory
• http://secunia.com/advisories/18092 · Vendor Advisory
• http://secunia.com/advisories/17748 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200601-10.xml · Vendor Advisory
• http://vupen.com/english/advisories/2005/2636 · Vendor Advisory
• http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102003-1 · Vendor Advisory
• http://kb.cert.org/vuls/id/974188 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23251 · Note
• http://www-1.ibm.com/support/docview.wss?uid=swg21225628 · Note