CVE-2006-6731
Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5...
CVE-2006-6731 is a high vulnerability (CVSS 9.3) in Sun Jdk, published December 26, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.85%, the 90th percentile. No source names a fixed version.
- Severity
- 9.3 HighCVSS 2.0, NVD
- Exploit chance
- 3.85%EPSS, 90th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allow attackers to develop Java applets that read, write, or execute local files, possibly related to (1) integer overflows in the Java_sun_awt_image_ImagingLib_convolveBI, awt_parseRaster, and awt_parseColorModel functions; (2) a stack overflow in the Java_sun_awt_image_ImagingLib_lookupByteRaster function; and (3) improper handling of certain negative values in the Java_sun_font_SunLayoutEngine_nativeLayout function. NOTE: some of these details are obtained from third party information.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.4.2-ibmRed Hat:rhel_extras:3 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el3 | 0:1.4.2.7-1jpp.4.el3 |
java-1.4.2-ibm-demoRed Hat:rhel_extras:3 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el3 | 0:1.4.2.7-1jpp.4.el3 |
java-1.4.2-ibm-develRed Hat:rhel_extras:3 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el3 | 0:1.4.2.7-1jpp.4.el3 |
java-1.4.2-ibm-jdbcRed Hat:rhel_extras:3 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el3 | 0:1.4.2.7-1jpp.4.el3 |
java-1.4.2-ibm-pluginRed Hat:rhel_extras:3 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el3 | 0:1.4.2.7-1jpp.4.el3 |
java-1.4.2-ibm-srcRed Hat:rhel_extras:3 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el3 | 0:1.4.2.7-1jpp.4.el3 |
java-1.4.2-ibmRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el4 | 0:1.4.2.7-1jpp.4.el4 |
java-1.4.2-ibm-demoRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el4 | 0:1.4.2.7-1jpp.4.el4 |
java-1.4.2-ibm-develRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el4 | 0:1.4.2.7-1jpp.4.el4 |
java-1.4.2-ibm-javacommRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el4 | 0:1.4.2.7-1jpp.4.el4 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.4.2-ibm-jdbcRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el4 | 0:1.4.2.7-1jpp.4.el4 |
java-1.4.2-ibm-pluginRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el4 | 0:1.4.2.7-1jpp.4.el4 |
java-1.4.2-ibm-srcRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 0:1.4.2.7-1jpp.4.el4 | 0:1.4.2.7-1jpp.4.el4 |
IBMJava2-JRERed Hat:enterprise_linux:2.1::as From an advisory covering 5 CVEs | before 1:1.3.1-12 | 1:1.3.1-12 |
IBMJava2-SDKRed Hat:enterprise_linux:2.1::as From an advisory covering 5 CVEs | before 1:1.3.1-11 | 1:1.3.1-11 |
IBMJava2-JRERed Hat:enterprise_linux:2.1::es From an advisory covering 5 CVEs | before 1:1.3.1-12 | 1:1.3.1-12 |
IBMJava2-SDKRed Hat:enterprise_linux:2.1::es From an advisory covering 5 CVEs | before 1:1.3.1-11 | 1:1.3.1-11 |
IBMJava2-JRERed Hat:enterprise_linux:2.1::ws From an advisory covering 5 CVEs | before 1:1.3.1-12 | 1:1.3.1-12 |
IBMJava2-SDKRed Hat:enterprise_linux:2.1::ws From an advisory covering 5 CVEs | before 1:1.3.1-11 | 1:1.3.1-11 |
java-1.5.0-ibmRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 1:1.5.0.3-1jpp.3.el4 | 1:1.5.0.3-1jpp.3.el4 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 1:1.5.0.3-1jpp.3.el4 | 1:1.5.0.3-1jpp.3.el4 |
java-1.5.0-ibm-develRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 1:1.5.0.3-1jpp.3.el4 | 1:1.5.0.3-1jpp.3.el4 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 1:1.5.0.3-1jpp.3.el4 | 1:1.5.0.3-1jpp.3.el4 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 1:1.5.0.3-1jpp.3.el4 | 1:1.5.0.3-1jpp.3.el4 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 1:1.5.0.3-1jpp.3.el4 | 1:1.5.0.3-1jpp.3.el4 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:4 From an advisory covering 4 CVEs | before 1:1.5.0.3-1jpp.3.el4 | 1:1.5.0.3-1jpp.3.el4 |
What each source reports
NVD Score used
Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allow attackers to develop Java applets that read, write, or execute local files, possibly related to (1) integer overflows in the Java_sun_awt_image_ImagingLib_convolveBI, awt_parseRaster, and awt_parseColorModel functions; (2) a stack overflow in the Java_sun_awt_image_ImagingLib_lookupByteRaster function; and (3) improper handling of certain negative values in the Java_sun_font_SunLayoutEngine_nativeLayout function. NOTE: some of these details are obtained from third party information.
- Record
CVE-2006-6731- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allow attackers to develop Java applets that read, write, or execute local files, possibly related to (1) integer overflows in the Java_sun_awt_image_ImagingLib_convolveBI, awt_parseRaster, and awt_parseColorModel functions; (2) a stack overflow in the Java_sun_awt_image_ImagingLib_lookupByteRaster function; and (3) improper handling of certain negative values in the Java_sun_font_SunLayoutEngine_nativeLayout function. NOTE: some of these details are obtained from third party information.
- Record
CVE-2006-6731- Updated
- 2026-11-02
EUVDEUVD-2006-6714No score
Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allow attackers to develop Java applets that read, write, or execute local files, possibly related to (1) integer overflows in the Java_sun_awt_image_ImagingLib_convolveBI, awt_parseRaster, and awt_parseColorModel functions; (2) a stack overflow in the Java_sun_awt_image_ImagingLib_lookupByteRaster function; and (3) improper handling of certain negative values in the Java_sun_font_SunLayoutEngine_nativeLayout function. NOTE: some of these details are obtained from third party information.
- Record
EUVD-2006-6714- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mqqx-775h-25rpNo score
Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5...
Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allow attackers to develop Java applets that read, write, or execute local files, possibly related to (1) integer overflows in the Java_sun_awt_image_ImagingLib_convolveBI, awt_parseRaster, and awt_parseColorModel functions; (2) a stack overflow in the Java_sun_awt_image_ImagingLib_lookupByteRaster function; and (3) improper handling of certain negative values in the Java_sun_font_SunLayoutEngine_nativeLayout function. NOTE: some of these details are obtained from third party information.
- Record
GHSA-mqqx-775h-25rp- Updated
- 2026-11-02
OSVRHSA-2007:0062
Red Hat Security Advisory: java-1.4.2-ibm security update
- Record
RHSA-2007:0062- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2007:0072
Red Hat Security Advisory: IBMJava2 security update
- Record
RHSA-2007:0072- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2007:0073
Red Hat Security Advisory: java-1.5.0-ibm security update
- Record
RHSA-2007:0073- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, references | OSV | |
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/21675
docs.info.apple.com/article.html?artnum=307177
vupen.com/english/advisories/2006/5073
secunia.com/advisories/24468
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00876579
sunsolve.sun.com/search/document.do?assetkey=1-26-102729-1
Show 194 moreShow less
redhat.com/support/errata/RHSA-2007-0062.html
scary.beasts.org/security/CESA-2005-008.txt
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10134
lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
lists.suse.com/archive/suse-security-announce/2007-Jan/0003.html
kb.cert.org/vuls/id/939609
novell.com/linux/security/advisories/2007_10_ibmjava.html
securitytracker.com/id?1017425
gentoo.org/security/en/glsa/glsa-200705-20.xml
security.gentoo.org/glsa/glsa-200702-08.xml
us-cert.gov/cas/techalerts/TA07-022A.html
dev2dev.bea.com/pub/advisory/243
nvd.nist.gov/vuln/detail/CVE-2006-6731
github.com/advisories/GHSA-mqqx-775h-25rp
access.redhat.com/errata/RHSA-2007:0062
www-128.ibm.com/developerworks/java/jdk/alerts
bugzilla.redhat.com/show_bug.cgi?id=226981
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0062.json
cve.org/CVERecord?id=CVE-2006-4339
itrc.hp.com/service/cki/docDisplay.do?docId=c00849540
jvn.jp/en/jp/JVN51615542/index.html
jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000079.html
lists.vmware.com/pipermail/security-announce/2008/000008.html
marc.info?l=bind-announce&m=116253119512445&w=2
openvpn.net/changelog.html
security.freebsd.org/advisories/FreeBSD-SA-06:19.openssl.asc
slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.566955
support.attachmate.com/techdocs/2127.html
support.avaya.com/elmodocs2/security/ASA-2006-188.htm
arkoon.fr/upload/alertes/40AK-2006-04-FR-1.1_SSL360_OPENSSL_RSA.pdf
bluecoat.com/support/knowledge/openSSL_RSA_Signature_forgery.html
cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html
debian.org/security/2006/dsa-1174
imc.org/ietf-openpgp/mail-archive/msg14307.html
mandriva.com/security/advisories?name=MDKSA-2006:161
matasano.com/log/469/many-rsa-signatures-may-be-forgeable-in-openssl-and-elsewhere
openbsd.org/errata.html
openoffice.org/security/cves/CVE-2006-4339.html
openpkg.com/security/advisories/OpenPKG-SA-2006.018.html
openpkg.org/security/advisories/OpenPKG-SA-2006.029-bind.html
openssl.org/news/secadv_20060905.txt
opera.com/support/search/supsearch.dml?index=845
oracle.com/technetwork/topics/security/cpujan2007-101493.html
osvdb.org/28549
serv-u.com/releasenotes
sybase.com/detail?id=1047991
ubuntu.com/usn/usn-339-1
us.debian.org/security/2006/dsa-1173
vmware.com/security/advisories/VMSA-2008-0005.html
www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00771742
www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117
exchange.xforce.ibmcloud.com/vulnerabilities/28755
issues.rpath.com/browse/RPL-1633
secure-support.novell.com/KanisaPlatform/Publishing/41/3143224_f.SAL_Public.html
www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144
Left out here: 55 references. The JSON record has them.