CVE-2007-3655

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier,...

6.8 MediumPublic exploit

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.

Exploit likelihood

12.3%Down 32.4 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2007-3655
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2007-3655
Updated: 2026-11-02

EUVDEUVD-2007-3639 No score

Record: EUVD-2007-3639
Updated: 2026-11-03

GitHub AdvisoriesGHSA-mhwx-cv4j-f56v No score

Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier,...

Record: GHSA-mhwx-cv4j-f56v
Weakness: CWE-119
Updated: 2026-11-02

Affected products

sun jre

Affected packages

Affected packages
Package	Affected	Fixed
`java-1.5.0-sun` Red Hat:rhel_extras:4 From an advisory covering 4 CVEs	before 0:1.5.0.12-1jpp.2.el4	0:1.5.0.12-1jpp.2.el4
`java-1.5.0-sun-demo` Red Hat:rhel_extras:4 From an advisory covering 4 CVEs	before 0:1.5.0.12-1jpp.2.el4	0:1.5.0.12-1jpp.2.el4
`java-1.5.0-sun-devel` Red Hat:rhel_extras:4 From an advisory covering 4 CVEs	before 0:1.5.0.12-1jpp.2.el4	0:1.5.0.12-1jpp.2.el4
`java-1.5.0-sun-jdbc` Red Hat:rhel_extras:4 From an advisory covering 4 CVEs	before 0:1.5.0.12-1jpp.2.el4	0:1.5.0.12-1jpp.2.el4
`java-1.5.0-sun-plugin` Red Hat:rhel_extras:4 From an advisory covering 4 CVEs	before 0:1.5.0.12-1jpp.2.el4	0:1.5.0.12-1jpp.2.el4
`java-1.5.0-sun-src` Red Hat:rhel_extras:4 From an advisory covering 4 CVEs	before 0:1.5.0.12-1jpp.2.el4	0:1.5.0.12-1jpp.2.el4
`java-1.5.0-ibm` Red Hat:rhel_extras:4 From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.2.el4	1:1.5.0.5-1jpp.2.el4
`java-1.5.0-ibm-demo` Red Hat:rhel_extras:4 From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.2.el4	1:1.5.0.5-1jpp.2.el4
`java-1.5.0-ibm-devel` Red Hat:rhel_extras:4 From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.2.el4	1:1.5.0.5-1jpp.2.el4
`java-1.5.0-ibm-javacomm` Red Hat:rhel_extras:4 From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.2.el4	1:1.5.0.5-1jpp.2.el4

Show 17 moreShow less

Affected packages
Package	Affected	Fixed
`java-1.5.0-ibm-jdbc` Red Hat:rhel_extras:4 From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.2.el4	1:1.5.0.5-1jpp.2.el4
`java-1.5.0-ibm-plugin` Red Hat:rhel_extras:4 From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.2.el4	1:1.5.0.5-1jpp.2.el4
`java-1.5.0-ibm-src` Red Hat:rhel_extras:4 From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.2.el4	1:1.5.0.5-1jpp.2.el4
`java-1.5.0-ibm` Red Hat:rhel_extras:5::client From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-demo` Red Hat:rhel_extras:5::client From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-devel` Red Hat:rhel_extras:5::client From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-javacomm` Red Hat:rhel_extras:5::client From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-jdbc` Red Hat:rhel_extras:5::client From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-plugin` Red Hat:rhel_extras:5::client From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-src` Red Hat:rhel_extras:5::client From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm` Red Hat:rhel_extras:5::server From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-demo` Red Hat:rhel_extras:5::server From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-devel` Red Hat:rhel_extras:5::server From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-javacomm` Red Hat:rhel_extras:5::server From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-jdbc` Red Hat:rhel_extras:5::server From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-plugin` Red Hat:rhel_extras:5::server From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5
`java-1.5.0-ibm-src` Red Hat:rhel_extras:5::server From an advisory covering 7 CVEs	before 1:1.5.0.5-1jpp.0.1.el5	1:1.5.0.5-1jpp.0.1.el5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Sun Java Runtime Environment 1.6 - Web Start '.JNLP' File Stack Buffer Overflow	2007-07-09
Exploit-DB	Sun Java WebStart - JNLP Stack Buffer Overflow (PoC)	2007-07-10

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	affected, aliases, exploits, facts, references, title	Exploit-DB, GitHub Advisories, OSV
Nov 2, 2026	first indexed	CVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-3655 is a medium vulnerability (CVSS 6.8) in Sun Jre, published July 10, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.3%, the 96th percentile. No source names a fixed version.

References

Show 63 moreShow less