CVE-2007-3715

CRITICAL 9.3CVE-2007-3715 · Published 11/07/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
java system application server sun	`= 8.2= 9.0`	No fix yet
java system web server sun	`= 7.0`	No fix yet

Description

Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3716.

References

osvdb.org/37248
secunia.com/advisories/26023 · Vendor Advisory
sunsolve.sun.com/search/document.do · Patch
sunsolve.sun.com/search/document.do · Vendor Advisory
isecpartners.com/advisories/2007-04-dsig.txt
isecpartners.com/files/XMLDSIG_Command_Injection.pdf
securityfocus.com/archive/1/473552/100/0/threaded
securityfocus.com/archive/1/473553/100/0/threaded
securityfocus.com/bid/24850 · Patch
vupen.com/english/advisories/2007/2493 · Vendor Advisory
vupen.com/english/advisories/2007/2785 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/35335

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free