CVE-2007-0012

Severity CVSS v4.0:

Pending analysis

Type:

CWE-20 Input Validation

Publication date:

09/01/2008

Last modified:

09/04/2025

Description

Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service (Internet Explorer crash) via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM.

Impact

Vector 2.0

AV:N/AC:M/Au:N/C:N/I:N/A:P CVSS v2.0 Severity and Metrics:

Base Score: 4.30 MEDIUM
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Attack Vector (AV): Network
Attack Complexity (AC): Medium
Authentication (Au): None
Confidentiality (C): None
Integrity (I): None
Availability (A): Physical

Base Score 2.0

4.30

Severity 2.0

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:sun:jre::update10::::::*		1.5.0 (including)
cpe:2.3:a:sun:jre::update11::::::*		1.5.0 (including)
cpe:2.3:a:sun:jre::update12::::::*		1.5.0 (including)
cpe:2.3:a:sun:jre::update13::::::*		1.5.0 (including)
cpe:2.3:a:sun:jre::update7::::::*		1.5.0 (including)
cpe:2.3:a:sun:jre::update8::::::*		1.5.0 (including)
cpe:2.3:a:sun:jre::update9::::::*		1.5.0 (including)

To consult the complete list of CPE names with products and versions, see this page

CVE-2007-0012

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools