CVE-2007-3922

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-07-21 · updated 2026-06-16

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) Applet Class Loader in Sun JDK and JRE 5.0 Update 11 and earlier, 6 through 6 Update 1, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to violate the security model for an applet's outbound connections by connecting to certain localhost services running on the machine that loaded the applet.

Affected products

Sun Jdk: through 1.5.0; through 1.6.0
Sun Jre: through 1.5.0; through 1.6.0
Sun Sdk: through 1.4.2_14

References

http://dev2dev.bea.com/pub/advisory/248
http://docs.info.apple.com/article.html?artnum=307177
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
http://secunia.com/advisories/26314
http://secunia.com/advisories/26369
http://secunia.com/advisories/26631
http://secunia.com/advisories/26645
http://secunia.com/advisories/26933
http://secunia.com/advisories/27266
http://secunia.com/advisories/27635
http://secunia.com/advisories/28115

Get alerted when CVE-2007-3922 or the next vulnerability affects your stack