CVE-2007-4381

HIGH

Description

Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to perform unauthorized actions via an applet that grants certain privileges to itself.

References

http://dev2dev.bea.com/pub/advisory/248

http://docs.info.apple.com/article.html?artnum=307177

http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html

http://secunia.com/advisories/26402

http://secunia.com/advisories/26631

http://secunia.com/advisories/26933

http://secunia.com/advisories/27203

http://secunia.com/advisories/27716

http://secunia.com/advisories/28056

http://secunia.com/advisories/28115

http://secunia.com/advisories/28777

http://secunia.com/advisories/28880

http://secunia.com/advisories/29340

http://secunia.com/advisories/29897

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103024-1

http://support.novell.com/techcenter/psdb/0c36b6416afc3868b8b1b9012955e323.html

http://www.gentoo.org/security/en/glsa/glsa-200709-15.xml

http://www.redhat.com/support/errata/RHSA-2007-0956.html

http://www.redhat.com/support/errata/RHSA-2007-1086.html

http://www.redhat.com/support/errata/RHSA-2008-0100.html

http://www.redhat.com/support/errata/RHSA-2008-0132.html

http://www.securityfocus.com/bid/25340

http://www.securitytracker.com/id?1018576

http://www.vupen.com/english/advisories/2007/2910

http://www.vupen.com/english/advisories/2007/3009

http://www.vupen.com/english/advisories/2007/4224

https://exchange.xforce.ibmcloud.com/vulnerabilities/36061

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10290

Details

Source: MITRE

Published: 2007-08-17

Updated: 2017-09-29

Risk Information

CVSS v2.0

Base Score: 9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 8.6

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:sun:jdk:*:update9:*:*:*:*:*:* versions up to 1.5.0 (inclusive)

cpe:2.3:a:sun:jre:*:update14:*:*:*:*:*:* versions up to 1.4.2 (inclusive)

cpe:2.3:a:sun:sdk:*:*:*:*:*:*:*:* versions up to 1.4.2_14 (inclusive)

Tenable Plugins

View all (13 total)

IDNameProductFamilySeverity
64823Sun Java JRE Font Parsing Privilege Escalation (103024) (Unix)NessusMisc.
high
63846RHEL 4 : java-1.4.2-bea (RHSA-2007:1086)NessusRed Hat Local Security Checks
high
41210SuSE9 Security Update : IBM Java 2 JRE and SDK (YOU Patch Number 12142)NessusSuSE Local Security Checks
high
40714RHEL 3 / 4 / 5 : java-1.4.2-ibm (RHSA-2008:0132)NessusRed Hat Local Security Checks
high
40712RHEL 3 / 4 / 5 : java-1.4.2-bea (RHSA-2008:0100)NessusRed Hat Local Security Checks
high
40708RHEL 4 / 5 : java-1.5.0-bea (RHSA-2007:0956)NessusRed Hat Local Security Checks
high
40706RHEL 4 / 5 : java-1.5.0-ibm (RHSA-2007:0829)NessusRed Hat Local Security Checks
critical
32050SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 5183)NessusSuSE Local Security Checks
critical
32049SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 5182)NessusSuSE Local Security Checks
high
29702Mac OS X : Java for Mac OS X 10.4 Release 6NessusMacOS X Local Security Checks
critical
29476SuSE 10 Security Update : java-1_5_0-ibm (ZYPP Patch Number 4687)NessusSuSE Local Security Checks
high
26117GLSA-200709-15 : BEA JRockit: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
25903Sun Java JRE Font Parsing Privilege Escalation (103024)NessusWindows
high