CVE-2007-3655

MEDIUM 6.8CVE-2007-3655 · Published 10/07/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
jre sun	`= 1.5.0= 1.6.0`	No fix yet

Description

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.

References

docs.info.apple.com/article.html
lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
lists.grok.org.uk/pipermail/full-disclosure/2007-July/064552.html
osvdb.org/37756
research.eeye.com/html/advisories/published/AD20070705.html
secunia.com/advisories/25981 · Vendor Advisory
secunia.com/advisories/26314 · Vendor Advisory
secunia.com/advisories/26369 · Vendor Advisory
secunia.com/advisories/27266 · Vendor Advisory
secunia.com/advisories/28115 · Vendor Advisory
secunia.com/advisories/29858 · Vendor Advisory
secunia.com/advisories/30780 · Vendor Advisory
security.gentoo.org/glsa/glsa-200804-28.xml
securityreason.com/securityalert/2874
sunsolve.sun.com/search/document.do
exploit-db.com/exploits/30284
gentoo.org/security/en/glsa/glsa-200804-20.xml
gentoo.org/security/en/glsa/glsa-200806-11.xml
novell.com/linux/security/advisories/2007_56_ibmjava.html
redhat.com/support/errata/RHSA-2007-0818.html
redhat.com/support/errata/RHSA-2007-0829.html
securityfocus.com/archive/1/473224/100/0/threaded
securityfocus.com/archive/1/473356/100/0/threaded
securityfocus.com/bid/24832 · Exploit
securitytracker.com/id
vupen.com/english/advisories/2007/2477 · Vendor Advisory
vupen.com/english/advisories/2007/4224 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/35320
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11367

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free