CVE-2003-0896
The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 14.3%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains "/" (slash) instead of "." (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 14.32% probability · 96th percentile
- CISA KEV
- Not listed
- Affected
- sun/jre
- Source
- cve@mitre.org
References
- http://lsd-pl.net/code/JVM/jre.tar.gz
- http://marc.info/?l=bugtraq&m=106692334503819&w=2
- http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57221
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200356-1
- http://www.securityfocus.com/advisories/6028
- http://www.securityfocus.com/archive/1/342580
- http://www.securityfocus.com/archive/1/342583
- http://www.securityfocus.com/bid/8879
- http://lsd-pl.net/code/JVM/jre.tar.gz
- http://marc.info/?l=bugtraq&m=106692334503819&w=2
- http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57221
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200356-1
- http://www.securityfocus.com/advisories/6028
- http://www.securityfocus.com/archive/1/342580
- http://www.securityfocus.com/archive/1/342583
- http://www.securityfocus.com/bid/8879
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.