Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x be

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• sun jdkup to 5.0 inclusive
• sun jdkup to 6 inclusive
• sun jdk5.0
• sun jdk6
• sun jreup to 1.4.2_17 inclusive
• sun jreup to 5.0 inclusive
• sun jreup to 6 inclusive
• sun jre1.4.2
• sun jre1.4.2_01
• sun jre1.4.2_02
• sun jre1.4.2_03
• sun jre1.4.2_04
• sun jre1.4.2_05
• sun jre1.4.2_06
• sun jre1.4.2_07
• sun jre1.4.2_10
• sun jre1.4.2_11
• sun jre1.4.2_12
• sun jre1.4.2_13
• sun jre1.4.2_14

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2008-5353The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2
  66This week
• CVE-2009-3867Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before
  59Plan
• CVE-2009-3869Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE
  57Plan
• CVE-2008-3112Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE
  48Plan
• CVE-2011-0873Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, and 5.0 Update 29 and e
  42Plan
• CVE-2011-0862Multiple unspecified vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 2
  42Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.