PT-2007-5142 · Oracle · Java Runtime Environment+1

Published 2007-07-20 · Updated 2017-09-29 · CVE-2007-3922

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Java Runtime Environment (JRE) versions 1.4.2 14 and earlier Java Runtime Environment (JRE) versions 5.0 Update 11 and earlier Java Runtime Environment (JRE) versions 6 through 6 Update 1

Description: The issue allows remote attackers to violate the security model for an applet's outbound connections by connecting to certain localhost services running on the machine that loaded the applet. This occurs due to an unspecified vulnerability in the Java Runtime Environment (JRE) Applet Class Loader.

Recommendations: For Java Runtime Environment (JRE) versions 1.4.2 14 and earlier, update to a version later than 1.4.2 14. For Java Runtime Environment (JRE) versions 5.0 Update 11 and earlier, update to a version later than 5.0 Update 11. For Java Runtime Environment (JRE) versions 6 through 6 Update 1, update to a version later than 6 Update 1.

Fix

Related Identifiers

CVE-2007-3922

RHSA-2007:0818

RHSA-2007:0829

RHSA-2008:0133

Affected Products

Java Platform

Java Runtime Environment

References · 32

• http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.486841 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_56_ibmjava.html · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/248 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0133.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3922 · Security Note
• http://redhat.com/support/errata/RHSA-2007-0818.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102995-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0829.html · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200709-15.xml · Vendor Advisory
• http://securitytracker.com/id?1018428 · Note
• http://secunia.com/advisories/26314 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10387 · Note
• http://vupen.com/english/advisories/2007/3861 · Note