CVE-2007-3655

Published: Jul 10, 2007Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.

Affected (12)

Products: Sun: Jre

Sun

1 product

Jre

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Sun Jre	Version 1.5.0 update10
Sun Jre	Version 1.5.0 update11
Sun Jre	Version 1.5.0 update1
Sun Jre	Version 1.5.0 update2
Sun Jre	Version 1.5.0 update3
Sun Jre	Version 1.5.0 update4
Sun Jre	Version 1.5.0 update5
Sun Jre	Version 1.5.0 update6
Sun Jre	Version 1.5.0 update7
Sun Jre	Version 1.5.0 update8
Sun Jre	Version 1.5.0 update9
Sun Jre	Version 1.6.0 update_1

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (58)

http://docs.info.apple.com/article.html?artnum=307177

Source: cve@mitre.org

http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html

Source: cve@mitre.org

http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064552.html

Source: cve@mitre.org

http://osvdb.org/37756

Source: cve@mitre.org

http://research.eeye.com/html/advisories/published/AD20070705.html

Source: cve@mitre.org

http://secunia.com/advisories/25981

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/26314

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/26369

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27266

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28115

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29858

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/30780

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200804-28.xml

Source: cve@mitre.org

http://securityreason.com/securityalert/2874

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102996-1

Source: cve@mitre.org

http://www.exploit-db.com/exploits/30284

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2007_56_ibmjava.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0818.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0829.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/473224/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/473356/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/24832

Source: cve@mitre.org

Exploit

http://www.securitytracker.com/id?1018346

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/2477

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2007/4224

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/35320

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11367

Source: cve@mitre.org

http://docs.info.apple.com/article.html?artnum=307177