vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2007-5274

N/A
Published: October 8, 2007 at 11:00 PM UTC
Updated: June 16, 2026 at 10:45 PM UTC
3 products affected across 1 vendorJREJDKSDK· also runs on 2 platforms

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 3%

Description

Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound connections via a multi-pin DNS rebinding attack dependent on the LiveConnect API, in which JavaScript download relies on DNS resolution by the browser, but JavaScript socket operations rely on separate DNS resolution by a Java Virtual Machine (JVM), a different issue than CVE-2007-5273. NOTE: this is similar to CVE-2007-5232.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

JDK· Sun
95%
v ≤ 1.6.01.5.0 update11.5.0 update101.5.0 update111.5.0 update121.5.0 update21.5.0 update31.5.0 update41.5.0 update51.5.0 update71.5.0 update81.5.0 update91.6.0 update11.6.0 update266 update_1update2
mozilla-firefox (environment) · opera-opera-browser (environment)
JRE· Sun
95%
v ≤ 1.3.1v ≤ 1.4.2v ≤ 1.6.01.3.01.3.0 update51.3.1 update11.3.1 update161.3.1 update181.3.1 update191.3.1 update1a1.41.4.1 update31.4.21.4.2_11.4.2_101.4.2_111.4.2_121.4.2_131.4.2_141.4.2_31.4.2_81.4.2_91.5.0 update11.5.0 update101.5.0 update111.5.0 update121.5.0 update21.5.0 update31.5.0 update41.5.0 update51.5.0 update61.5.0 update71.5.0 update81.5.0 update91.6.0 update_1update15update2update20
mozilla-firefox (environment) · opera-opera-browser (environment)
SDK· Sun
95%
v ≤ 1.3.1_201.3.1_011.3.1_01a1.3.1_161.3.1_181.3.1_191.4.21.4.2_031.4.2_081.4.2_091.4.2_101.4.2_111.4.2_121.4.2_131.4.2_141.4.2_15
mozilla-firefox (environment) · opera-opera-browser (environment)

Runs on — not affected

The affected product only carries this flaw when running on these platforms. The platforms themselves are not vulnerable.

References (34)

x_refsource_MISC
Source: [email protected]
http://crypto.stanford.edu/dns/dns-rebinding.pdf
Vendor Advisoryx_refsource_BEA
Source: [email protected]
http://dev2dev.bea.com/pub/advisory/272
Vendor Advisoryx_refsource_HP
Source: [email protected]
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01234533
Vendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/27206
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/27261
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/27693
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/27716

CVSS

2.6LOW[email protected]
Confidentiality
NONE
Integrity
PARTIAL
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-Other

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card