CVE-2007-2435
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1...
10.0 HighFix available
CVE-2007-2435 is a high vulnerability (CVSS 10.0) in Sun Jre, published May 2, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.96%, the 92nd percentile. Fixed in java-1.4.2-ibm 0:1.4.2.9-1jpp.1.el3.
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.
Exploit likelihood
4.96%Up 0.6 points since Feb 4, 2022
What each source reports
NVD Score used
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.
- Record
CVE-2007-2435- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.
- Record
CVE-2007-2435- Updated
- 2026-11-02
EUVDEUVD-2007-2430 No score
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.
- Record
EUVD-2007-2430- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9ffv-4whq-h9qg No score
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1...
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.
- Record
GHSA-9ffv-4whq-h9qg- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.4.2-ibmRed Hat:rhel_extras:3 |
before 0:1.4.2.9-1jpp.1.el3 | 0:1.4.2.9-1jpp.1.el3 |
java-1.4.2-ibm-demoRed Hat:rhel_extras:3 |
before 0:1.4.2.9-1jpp.1.el3 | 0:1.4.2.9-1jpp.1.el3 |
java-1.4.2-ibm-develRed Hat:rhel_extras:3 |
before 0:1.4.2.9-1jpp.1.el3 | 0:1.4.2.9-1jpp.1.el3 |
java-1.4.2-ibm-jdbcRed Hat:rhel_extras:3 |
before 0:1.4.2.9-1jpp.1.el3 | 0:1.4.2.9-1jpp.1.el3 |
java-1.4.2-ibm-pluginRed Hat:rhel_extras:3 |
before 0:1.4.2.9-1jpp.1.el3 | 0:1.4.2.9-1jpp.1.el3 |
java-1.4.2-ibm-srcRed Hat:rhel_extras:3 |
before 0:1.4.2.9-1jpp.1.el3 | 0:1.4.2.9-1jpp.1.el3 |
java-1.4.2-ibmRed Hat:rhel_extras:4 |
before 0:1.4.2.9-1jpp.1.el4 | 0:1.4.2.9-1jpp.1.el4 |
java-1.4.2-ibm-demoRed Hat:rhel_extras:4 |
before 0:1.4.2.9-1jpp.1.el4 | 0:1.4.2.9-1jpp.1.el4 |
java-1.4.2-ibm-develRed Hat:rhel_extras:4 |
before 0:1.4.2.9-1jpp.1.el4 | 0:1.4.2.9-1jpp.1.el4 |
java-1.4.2-ibm-javacommRed Hat:rhel_extras:4 |
before 0:1.4.2.9-1jpp.1.el4 | 0:1.4.2.9-1jpp.1.el4 |
Show 74 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.4.2-ibm-jdbcRed Hat:rhel_extras:4 |
before 0:1.4.2.9-1jpp.1.el4 | 0:1.4.2.9-1jpp.1.el4 |
java-1.4.2-ibm-pluginRed Hat:rhel_extras:4 |
before 0:1.4.2.9-1jpp.1.el4 | 0:1.4.2.9-1jpp.1.el4 |
java-1.4.2-ibm-srcRed Hat:rhel_extras:4 |
before 0:1.4.2.9-1jpp.1.el4 | 0:1.4.2.9-1jpp.1.el4 |
java-1.4.2-ibmRed Hat:rhel_extras:5::client |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-demoRed Hat:rhel_extras:5::client |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-develRed Hat:rhel_extras:5::client |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-javacommRed Hat:rhel_extras:5::client |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-jdbcRed Hat:rhel_extras:5::client |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-pluginRed Hat:rhel_extras:5::client |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-srcRed Hat:rhel_extras:5::client |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibmRed Hat:rhel_extras:5::server |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-demoRed Hat:rhel_extras:5::server |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-develRed Hat:rhel_extras:5::server |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-javacommRed Hat:rhel_extras:5::server |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-jdbcRed Hat:rhel_extras:5::server |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-pluginRed Hat:rhel_extras:5::server |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.4.2-ibm-srcRed Hat:rhel_extras:5::server |
before 0:1.4.2.9-1jpp.1.el5 | 0:1.4.2.9-1jpp.1.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:4 |
before 1:1.5.0.5-1jpp.2.el4 | 1:1.5.0.5-1jpp.2.el4 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:4 |
before 1:1.5.0.5-1jpp.2.el4 | 1:1.5.0.5-1jpp.2.el4 |
java-1.5.0-ibm-develRed Hat:rhel_extras:4 |
before 1:1.5.0.5-1jpp.2.el4 | 1:1.5.0.5-1jpp.2.el4 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:4 |
before 1:1.5.0.5-1jpp.2.el4 | 1:1.5.0.5-1jpp.2.el4 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:4 |
before 1:1.5.0.5-1jpp.2.el4 | 1:1.5.0.5-1jpp.2.el4 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:4 |
before 1:1.5.0.5-1jpp.2.el4 | 1:1.5.0.5-1jpp.2.el4 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:4 |
before 1:1.5.0.5-1jpp.2.el4 | 1:1.5.0.5-1jpp.2.el4 |
java-1.5.0-ibmRed Hat:rhel_extras:5::client |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::client |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::client |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::client |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::client |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::client |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::client |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:5::server |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::server |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::server |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::server |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::server |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::server |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::server |
before 1:1.5.0.5-1jpp.0.1.el5 | 1:1.5.0.5-1jpp.0.1.el5 |
jabberdRed Hat:network_satellite:5.0:el4 |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:5.0:el4 |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:5.0:el4 |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:5.0:el4 |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:5.0:el4 |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:5.0:el4 |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:5.0:el4 |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:5.0:el4 |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:5.0:el4 |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:5.0:el4 |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:5.0:el4 |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:5.0:el4 |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el3 |
before 0:2.0s10-3.37.rhn | 0:2.0s10-3.37.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el3 |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el3 |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
jfreechartRed Hat:network_satellite:4.2::el3 |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el3 |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el3 |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el3 |
before 0:2.24-1.el3 | 0:2.24-1.el3 |
rhn-apacheRed Hat:network_satellite:4.2::el3 |
before 0:1.3.27-36.rhn.rhel3 | 0:1.3.27-36.rhn.rhel3 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el3 |
before 0:1.2.23-2rhn.rhel3 | 0:1.2.23-2rhn.rhel3 |
rhn-modperlRed Hat:network_satellite:4.2::el3 |
before 0:1.29-16.rhel3 | 0:1.29-16.rhel3 |
rhn-modsslRed Hat:network_satellite:4.2::el3 |
before 0:2.8.12-8.rhn.10.rhel3 | 0:2.8.12-8.rhn.10.rhel3 |
tomcat5Red Hat:network_satellite:4.2::el3 |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el4 |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el4 |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el4 |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:4.2::el4 |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el4 |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el4 |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el4 |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:4.2::el4 |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el4 |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:4.2::el4 |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:4.2::el4 |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:4.2::el4 |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
docs.info.apple.com/article.html?artnum=307177
dev2dev.bea.com/pub/advisory/241
securityfocus.com/bid/23728
vupen.com/english/advisories/2007/1814
secunia.com/advisories/26311
support.avaya.com/elmodocs2/security/ASA-2007-199.htm
Show 194 moreShow less
osvdb.org/35483
gentoo.org/security/en/glsa/glsa-200705-23.xml
security.gentoo.org/glsa/glsa-200804-28.xml
lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
redhat.com/support/errata/RHSA-2007-0817.html
sunsolve.sun.com/search/document.do?assetkey=1-26-102881-1
exchange.xforce.ibmcloud.com/vulnerabilities/33984
securitytracker.com/id?1017986
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10999
nvd.nist.gov/vuln/detail/CVE-2007-2435
github.com/advisories/GHSA-9ffv-4whq-h9qg
access.redhat.com/errata/RHSA-2007:0817
bugzilla.redhat.com/show_bug.cgi?id=239660
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0817.json
cve.org/CVERecord?id=CVE-2007-2435
This page doesn't list everything
Left out here: 13 references. The JSON record has them.