CVE-2005-3905
Unspecified vulnerability in reflection APIs in Java SDK and JRE 1.3.1_15 and earlier, 1.4.2_08 and earlier, and JDK and JRE 5.0 Update 3 and earlier allows remote attackers to escape the Java sandbox and access arbitrary files or execute arbitrary…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unspecified vulnerability in reflection APIs in Java SDK and JRE 1.3.1_15 and earlier, 1.4.2_08 and earlier, and JDK and JRE 5.0 Update 3 and earlier allows remote attackers to escape the Java sandbox and access arbitrary files or execute arbitrary application via unknown attack vectors, a different vulnerability than CVE-2005-3906. NOTE: this is associated with the "first issue" identified in SUNALERT:102003.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 5.17% probability · 92th percentile
- CISA KEV
- Not listed
- Affected
- sun/jdk · sun/jre
- Source
- cve@mitre.org
References
- http://lists.apple.com/archives/security-announce/2005/Nov/msg00004.html
- http://secunia.com/advisories/17748Patch, Vendor Advisory
- http://secunia.com/advisories/17847Vendor Advisory
- http://secunia.com/advisories/18092Vendor Advisory
- http://secunia.com/advisories/18435Vendor Advisory
- http://secunia.com/advisories/18503Vendor Advisory
- http://securitytracker.com/id?1015280
- http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102003-1Patch, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg21225628
- http://www.gentoo.org/security/en/glsa/glsa-200601-10.xml
- http://www.kb.cert.org/vuls/id/974188US Government Resource
- http://www.securityfocus.com/bid/15615
- http://www.vupen.com/english/advisories/2005/2636Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2675Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2946Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23251
- http://lists.apple.com/archives/security-announce/2005/Nov/msg00004.html
- http://secunia.com/advisories/17748Patch, Vendor Advisory
- http://secunia.com/advisories/17847Vendor Advisory
- http://secunia.com/advisories/18092Vendor Advisory
- http://secunia.com/advisories/18435Vendor Advisory
- http://secunia.com/advisories/18503Vendor Advisory
- http://securitytracker.com/id?1015280
- http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102003-1Patch, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg21225628
- http://www.gentoo.org/security/en/glsa/glsa-200601-10.xml
- http://www.kb.cert.org/vuls/id/974188US Government Resource
- http://www.securityfocus.com/bid/15615
- http://www.vupen.com/english/advisories/2005/2636Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2675Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.