CVE - CVE-2007-5239

CVE-ID
CVE-2007-5239	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier does not properly enforce access restrictions for untrusted (1) applications and (2) applets, which allows user-assisted remote attackers to copy or rename arbitrary files when local users perform drag-and-drop operations from the untrusted application or applet window onto certain types of desktop applications.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20071029 FLEA-2007-0061-1 sun-jre sun-jdk URL:http://www.securityfocus.com/archive/1/482926/100/0/threaded CONFIRM:http://support.novell.com/techcenter/psdb/0c36b6416afc3868b8b1b9012955e323.html CONFIRM:http://www.vmware.com/security/advisories/VMSA-2008-0010.html BEA:BEA08-198.00 URL:http://dev2dev.bea.com/pub/advisory/272 GENTOO:GLSA-200804-20 URL:http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml GENTOO:GLSA-200804-28 URL:http://security.gentoo.org/glsa/glsa-200804-28.xml GENTOO:GLSA-200806-11 URL:http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml HP:HPSBUX02284 URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01234533 HP:SSRT071483 URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01234533 REDHAT:RHSA-2007:0963 URL:http://www.redhat.com/support/errata/RHSA-2007-0963.html REDHAT:RHSA-2007:1041 URL:http://www.redhat.com/support/errata/RHSA-2007-1041.html REDHAT:RHSA-2008:0132 URL:http://www.redhat.com/support/errata/RHSA-2008-0132.html REDHAT:RHSA-2008:0156 URL:http://www.redhat.com/support/errata/RHSA-2008-0156.html REDHAT:RHSA-2008:0100 URL:http://www.redhat.com/support/errata/RHSA-2008-0100.html SUNALERT:103072 URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-103072-1 SUSE:SUSE-SA:2007:055 URL:http://www.novell.com/linux/security/advisories/2007_55_java.html SUSE:SUSE-SA:2008:025 URL:http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html OVAL:oval:org.mitre.oval:def:8758 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8758 VUPEN:ADV-2007-3895 URL:http://www.vupen.com/english/advisories/2007/3895 VUPEN:ADV-2008-0609 URL:http://www.vupen.com/english/advisories/2008/0609 VUPEN:ADV-2008-1856 URL:http://www.vupen.com/english/advisories/2008/1856/references SECTRACK:1018814 URL:http://securitytracker.com/id?1018814 SECUNIA:27206 URL:http://secunia.com/advisories/27206 SECUNIA:27261 URL:http://secunia.com/advisories/27261 SECUNIA:27716 URL:http://secunia.com/advisories/27716 SECUNIA:27693 URL:http://secunia.com/advisories/27693 SECUNIA:27804 URL:http://secunia.com/advisories/27804 SECUNIA:28777 URL:http://secunia.com/advisories/28777 SECUNIA:28880 URL:http://secunia.com/advisories/28880 SECUNIA:29042 URL:http://secunia.com/advisories/29042 SECUNIA:29214 URL:http://secunia.com/advisories/29214 SECUNIA:29340 URL:http://secunia.com/advisories/29340 SECUNIA:29858 URL:http://secunia.com/advisories/29858 SECUNIA:29897 URL:http://secunia.com/advisories/29897 SECUNIA:30676 URL:http://secunia.com/advisories/30676 SECUNIA:30780 URL:http://secunia.com/advisories/30780 XF:sun-java-dragdrop-weak-security(36950) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/36950
Assigning CNA
N/A
Date Entry Created
20071005	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20071005)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org

Use of the Common Vulnerabilities and Exposures (CVE®) List and the associated references from this website are subject to the terms of use. CVE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 1999–2018, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation. For more information, please contact us.