CVE-2007-2435

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-05-02 · updated 2026-06-16
Weakness: CWE-264

Description

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.

Affected products

Sun Java Enterprise System: through 5.0
Sun Jre: through 1.4.2; through 1.5.0
Sun Sdk: through 1.4.3_13

References

http://dev2dev.bea.com/pub/advisory/241
http://docs.info.apple.com/article.html?artnum=307177
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
http://osvdb.org/35483
http://secunia.com/advisories/25069
http://secunia.com/advisories/25283
http://secunia.com/advisories/25413
http://secunia.com/advisories/25474
http://secunia.com/advisories/25832
http://secunia.com/advisories/26311
http://secunia.com/advisories/26369
http://secunia.com/advisories/28115

Get alerted when CVE-2007-2435 or the next vulnerability affects your stack