Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier does not properly enforce access restrictions for untrusted (1) applications and (2) applets, which allows user-assisted remote attackers to copy or rename arbitrary files when local users perform drag-and-drop operations from the untrusted application or applet window onto certain types of desktop applications.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jre | Sun | 1.3.1 | 1.3.1 |
| Sdk | Sun | 1.4.2 | 1.4.2 |
| Sdk | Sun | 1.3.1_19 | 1.3.1_19 |
| Jre | Sun | 1.3.1 | 1.3.1 |
| Sdk | Sun | 1.4.2_10 | 1.4.2_10 |
| Sdk | Sun | 1.4.2_12 | 1.4.2_12 |
| Jdk | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.4.1 | 1.4.1 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Sdk | Sun | 1.4.2_14 | 1.4.2_14 |
| Jre | Sun | 1.6.0 | 1.6.0 |
| Jre | Sun | 1.4.2_15 | 1.4.2_15 |
| Jre | Sun | 1.6.0 | 1.6.0 |
| Jre | Sun | 1.4.2_13 | 1.4.2_13 |
| Jre | Sun | 1.4.2_1 | 1.4.2_1 |
| Sdk | Sun | 1.4.2_13 | 1.4.2_13 |
| Jre | Sun | 1.4.2_8 | 1.4.2_8 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jdk | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.3.1 | 1.3.1 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jdk | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.4.2_12 | 1.4.2_12 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.3.1 | 1.3.1 |
| Jre | Sun | 1.3.0 | 1.3.0 |
| Jdk | Sun | 1.6.0 | 1.6.0 |
| Sdk | Sun | 1.3.1_20 | 1.3.1_20 |
| Sdk | Sun | 1.3.1_18 | 1.3.1_18 |
| Sdk | Sun | 1.3.1_01 | 1.3.1_01 |
| Jre | Sun | 1.4.2_14 | 1.4.2_14 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Sdk | Sun | 1.3.1_16 | 1.3.1_16 |
| Sdk | Sun | 1.3.1_01a | 1.3.1_01a |
| Jre | Sun | 1.3.0 | 1.3.0 |
| Jre | Sun | 1.4.2_10 | 1.4.2_10 |
| Jdk | Sun | 1.5.0 | 1.5.0 |
| Sdk | Sun | 1.4.2_09 | 1.4.2_09 |
| Jre | Sun | 1.3.1 | 1.3.1 |
| Jdk | Sun | 1.5.0 | 1.5.0 |
| Jdk | Sun | 1.6.0 | 1.6.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.4 | 1.4 |
| Jdk | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.4.2_9 | 1.4.2_9 |
| Jre | Sun | 1.4.2 | 1.4.2 |
| Sdk | Sun | 1.4.2_11 | 1.4.2_11 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.4.2_11 | 1.4.2_11 |
| Jdk | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jdk | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jdk | Sun | 1.5.0 | 1.5.0 |
| Sdk | Sun | 1.4.2_08 | 1.4.2_08 |
| Sdk | Sun | 1.4.2_03 | 1.4.2_03 |
| Jdk | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.3.1 | 1.3.1 |
| Jre | Sun | 1.4.2_3 | 1.4.2_3 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Sdk | Sun | 1.4.2_15 | 1.4.2_15 |
| Jdk | Sun | 1.5.0 | 1.5.0 |