CVE-2007-3698

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-07-11 · updated 2026-06-16

Description

The Java Secure Socket Extension (JSSE) in Sun JDK and JRE 6 Update 1 and earlier, JDK and JRE 5.0 Updates 7 through 11, and SDK and JRE 1.4.2_11 through 1.4.2_14, when using JSSE for SSL/TLS support, allows remote attackers to cause a denial of service (CPU consumption) via certain SSL/TLS handshake requests.

Affected products

Sun Jdk: 1.5.0-update10, 1.5.0-update11, 1.5.0-update7, 1.5.0-update8, 1.5.0-update9, 1.6.0-update1
Sun Jre: 1.4.2_11, 1.4.2_12, 1.4.2_13, 1.4.2_14, 1.5.0-update10, 1.5.0-update11 (+4)
Sun Sdk: 1.4.2_11, 1.4.2_12, 1.4.2_13, 1.4.2_14

References

http://dev2dev.bea.com/pub/advisory/249
http://docs.info.apple.com/article.html?artnum=307177
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html
http://osvdb.org/36663
http://secunia.com/advisories/26015
http://secunia.com/advisories/26221
http://secunia.com/advisories/26314
http://secunia.com/advisories/26631
http://secunia.com/advisories/26645
http://secunia.com/advisories/26933

Get alerted when CVE-2007-3698 or the next vulnerability affects your stack