Description
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.9-1jpp.1.el5 | RHSA-2007:0817 |
| RHEL 5 | java-1.5.0-ibm +6 | 1:1.5.0.5-1jpp.0.1.el5 | RHSA-2007:0829 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.9-1jpp.1.el4 | RHSA-2007:0817 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.5-1jpp.2.el4 | RHSA-2007:0829 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.9-1jpp.1.el3 | RHSA-2007:0817 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | openmotif21 | 2.1.30-11.RHEL4.6 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | perl-Crypt-CBC | 2.24-1.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modssl | 2.8.12-8.rhn.10.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0261 |
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
Advisories 4
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0829 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0817 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- http://docs.info.apple.com/article.html?artnum=307177
- BEA07-173.00 vendor-advisory
- 23728 vdb-entry
- ADV-2007-1814 vdb-entry
- 26311 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-199.htm
- 25283 third-party-advisory
- 35483 vdb-entry
- GLSA-200705-23 vendor-advisory
- ADV-2007-1598 vdb-entry
- 26369 third-party-advisory
- 25413 third-party-advisory
- GLSA-200804-28 vendor-advisory
- 29858 third-party-advisory
- APPLE-SA-2007-12-14 vendor-advisory
- RHSA-2007:0817 vendor-advisory
- 25832 third-party-advisory
- ADV-2007-4224 vdb-entry
- GLSA-200706-08 vendor-advisory
- 102881 vendor-advisory
- javawebstart-classes-privilege-escalation(33984) vdb-entry
- 30780 third-party-advisory
- 1017986 vdb-entry
- 25069 third-party-advisory
- 28115 third-party-advisory
- RHSA-2008:0261 vendor-advisory
- 25474 third-party-advisory
- GLSA-200804-20 vendor-advisory
- GLSA-200806-11 vendor-advisory
- oval:org.mitre.oval:def:10999 vdb-entry signature
- RHSA-2007:0829 vendor-advisory