CVE-2007-5274

Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 08 Oct 2007, 23:00
Last modified:07 Aug 2024, 15:24

Vulnerability Summary

Overall Risk (default)
low
11/100
CVSS Score
2.6 LOW
v2.0 (nvd)
EPSS Score
5.08% LOW
5% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 Oct 2007, 23:00
Published
Vulnerability first disclosed
07 Aug 2024, 15:24
Last Modified
Vulnerability information updated

Description

Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound connections via a multi-pin DNS rebinding attack dependent on the LiveConnect API, in which JavaScript download relies on DNS resolution by the browser, but JavaScript socket operations rely on separate DNS resolution by a Java Virtual Machine (JVM), a different issue than CVE-2007-5273. NOTE: this is similar to CVE-2007-5232.

CVSS Metrics

  • v2.0•LOW•Score: 2.6AV:N/AC:H/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 5.08%• Percentile: 90%

Affected Systems

  • sun•jdk

    ≤ 1.6.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update12 | 1.5.0:update2 | 1.5.0:update3 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update7 | 1.5.0:update8 | 1.5.0:update9 | 1.6.0:update1 | 1.6.0:update2 | 6 | 6:update_1

  • sun•jre

    ≤ 1.3.1 | ≤ 1.4.2 | ≤ 1.6.0 | 1.3.0 | 1.3.0:update5 | 1.3.1:update1 | 1.3.1:update16 | 1.3.1:update18 | 1.3.1:update19 | 1.3.1:update1a | 1.4 | 1.4.1:update3 | 1.4.2 | 1.4.2_1 | 1.4.2_3 | 1.4.2_8 | 1.4.2_9 | 1.4.2_10 | 1.4.2_11 | 1.4.2_12 | 1.4.2_13 | 1.4.2_14 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update12 | 1.5.0:update2 | 1.5.0:update3 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update8 | 1.5.0:update9 | 1.6.0:update_1

  • sun•sdk

    ≤ 1.3.1_20 | 1.3.1_01 | 1.3.1_01a | 1.3.1_16 | 1.3.1_18 | 1.3.1_19 | 1.4.2 | 1.4.2_03 | 1.4.2_08 | 1.4.2_09 | 1.4.2_10 | 1.4.2_11 | 1.4.2_12 | 1.4.2_13 | 1.4.2_14 | 1.4.2_15

References (34)