CVE-2005-3906
Multiple unspecified vulnerabilities in reflection APIs in Java SDK and JRE 1.4.2_08 and earlier and JDK and JRE 5.0 Update 3 and earlier allow remote attackers to escape the Java sandbox and access arbitrary files or execute arbitrary applications via…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple unspecified vulnerabilities in reflection APIs in Java SDK and JRE 1.4.2_08 and earlier and JDK and JRE 5.0 Update 3 and earlier allow remote attackers to escape the Java sandbox and access arbitrary files or execute arbitrary applications via unknown attack vectors, a different set of vulnerabilities than CVE-2005-3905. NOTE: this is associated with the "second and third issues" identified in SUNALERT:102003.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 5.17% probability · 92th percentile
- CISA KEV
- Not listed
- Affected
- sun/jdk · sun/jre
- Source
- cve@mitre.org
References
- http://lists.apple.com/archives/security-announce/2005/Nov/msg00004.html
- http://secunia.com/advisories/17748Patch, Vendor Advisory
- http://secunia.com/advisories/17847Vendor Advisory
- http://secunia.com/advisories/18092Vendor Advisory
- http://secunia.com/advisories/18435Vendor Advisory
- http://secunia.com/advisories/18503Vendor Advisory
- http://securitytracker.com/id?1015280
- http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102003-1Patch, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg21225628
- http://www.gentoo.org/security/en/glsa/glsa-200601-10.xml
- http://www.kb.cert.org/vuls/id/974188US Government Resource
- http://www.securityfocus.com/bid/15615
- http://www.vupen.com/english/advisories/2005/2636Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2675Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2946Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23251
- http://lists.apple.com/archives/security-announce/2005/Nov/msg00004.html
- http://secunia.com/advisories/17748Patch, Vendor Advisory
- http://secunia.com/advisories/17847Vendor Advisory
- http://secunia.com/advisories/18092Vendor Advisory
- http://secunia.com/advisories/18435Vendor Advisory
- http://secunia.com/advisories/18503Vendor Advisory
- http://securitytracker.com/id?1015280
- http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102003-1Patch, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg21225628
- http://www.gentoo.org/security/en/glsa/glsa-200601-10.xml
- http://www.kb.cert.org/vuls/id/974188US Government Resource
- http://www.securityfocus.com/bid/15615
- http://www.vupen.com/english/advisories/2005/2636Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2675Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.