CVE-2007-5236: Medium severity Java Development Kit (JDK) vulnerability

Published Oct 6, 2007

Updated

Java Web Start in Sun JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.215 and earlier, on Windows does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read local files via an untrusted application.

Affected Software

49 affected components

Java Development Kit (JDK)=1.5.0-update1

Java Development Kit (JDK)=1.5.0-update10

Java Development Kit (JDK)=1.5.0-update11

Java Development Kit (JDK)=1.5.0-update12

Java Development Kit (JDK)=1.5.0-update2

Java Development Kit (JDK)=1.5.0-update3

Java Development Kit (JDK)=1.5.0-update4

Java Development Kit (JDK)=1.5.0-update5

Java Development Kit (JDK)=1.5.0-update7

Java Development Kit (JDK)=1.5.0-update8

Java Development Kit (JDK)=1.5.0-update9

Sun Java Runtime Environment (JRE)=1.4.2

Sun Java Runtime Environment (JRE)=1.4.2_1

Sun Java Runtime Environment (JRE)=1.4.2_2

Sun Java Runtime Environment (JRE)=1.4.2_3

Sun Java Runtime Environment (JRE)=1.4.2_4

Sun Java Runtime Environment (JRE)=1.4.2_5

Sun Java Runtime Environment (JRE)=1.4.2_6

Sun Java Runtime Environment (JRE)=1.4.2_7

Sun Java Runtime Environment (JRE)=1.4.2_8

Sun Java Runtime Environment (JRE)=1.4.2_9

Sun Java Runtime Environment (JRE)=1.4.2_10

Sun Java Runtime Environment (JRE)=1.4.2_11

Sun Java Runtime Environment (JRE)=1.4.2_12

Sun Java Runtime Environment (JRE)=1.4.2_13

Sun Java Runtime Environment (JRE)=1.4.2_14

Sun Java Runtime Environment (JRE)=1.4.2_15

Sun Java Runtime Environment (JRE)=1.4.2_21

Sun Java Runtime Environment (JRE)=1.5.0-update1

Sun Java Runtime Environment (JRE)=1.5.0-update10

Sun Java Runtime Environment (JRE)=1.5.0-update11

Sun Java Runtime Environment (JRE)=1.5.0-update12

Sun Java Runtime Environment (JRE)=1.5.0-update2

Sun Java Runtime Environment (JRE)=1.5.0-update3

Sun Java Runtime Environment (JRE)=1.5.0-update4

Sun Java Runtime Environment (JRE)=1.5.0-update5

Sun Java Runtime Environment (JRE)=1.5.0-update6

Sun Java Runtime Environment (JRE)=1.5.0-update7

Sun Java Runtime Environment (JRE)=1.5.0-update8

Sun Java Runtime Environment (JRE)=1.5.0-update9

Sun SDK=1.4.2_03

Sun SDK=1.4.2_08

Sun SDK=1.4.2_09

Sun SDK=1.4.2_10

Sun SDK=1.4.2_11

Sun SDK=1.4.2_12

Sun SDK=1.4.2_13

Sun SDK=1.4.2_14

Sun SDK=1.4.2_15

Remediation

Patch Available

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103073-1

Event History

Oct 6, 2007

CVE Published

12:17 AM

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5236?

CVE-2007-5236 is considered a moderate severity vulnerability due to its potential for local file access by untrusted applications.

How do I fix CVE-2007-5236?

To fix CVE-2007-5236, upgrade to a patched version of the Sun JDK or JRE that is not vulnerable.

Which software versions are affected by CVE-2007-5236?

CVE-2007-5236 affects Sun JDK and JRE versions 5.0 Update 12 and earlier, and SDK and JRE 1.4.2_15 and earlier on Windows.

What type of vulnerabilities does CVE-2007-5236 exploit?

CVE-2007-5236 exploits improper enforcement of access restrictions for untrusted applications.

Who is at risk from CVE-2007-5236?

Users of affected versions of Sun JDK, JRE, and SDK, particularly on Windows, are at risk if they run untrusted applications.