Java in Netscape 4.5 does not properly restrict applets from connecting to other hosts…
Priority LOW 27Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Java in Netscape 4.5 does not properly restrict applets from connecting to other hosts besides the one from which the applet was loaded, which violates the Java security model and could allow remote attackers to conduct unauthorized activities.
Why it matters now
EPSS 0.0162 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netscape:communicator:4.01:*:*:*:*:*:*:* | 4.01 | Vulnerable | Netscape |
| cpe:2.3:a:netscape:communicator:4.5:*:*:*:*:*:*:* | 4.5 | Vulnerable | Netscape |
| cpe:2.3:a:netscape:communicator:4.06:*:*:*:*:*:*:* | 4.06 | Vulnerable | Netscape |
| cpe:2.3:a:netscape:communicator:4.07:*:*:*:*:*:*:* | 4.07 | Vulnerable | Netscape |
| cpe:2.3:a:netscape:communicator:4.08:*:*:*:*:*:*:* | 4.08 | Vulnerable | Netscape |
- cpe:2.3:a:netscape:communicator:4.01:*:*:*:*:*:*:* Versions 4.01 Vulnerable ·Netscape
- cpe:2.3:a:netscape:communicator:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Netscape
- cpe:2.3:a:netscape:communicator:4.06:*:*:*:*:*:*:* Versions 4.06 Vulnerable ·Netscape
- cpe:2.3:a:netscape:communicator:4.07:*:*:*:*:*:*:* Versions 4.07 Vulnerable ·Netscape
- cpe:2.3:a:netscape:communicator:4.08:*:*:*:*:*:*:* Versions 4.08 Vulnerable ·Netscape
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-1999-1262
- 2026-10-03 Alias added: GHSA-2ccq-2xr5-3q62
References
—
More Netscape Communicator vulnerabilities
- TI-2000-00709 Netscape Communicator does not properly prevent a ServerSocket object from being created… CVSS 2.0HIGH 7.5
- TI-2002-02160 Buffer overflow in the sun.awt.windows.WDefaultFontCharset Java class implementation in… CVSS 2.0HIGH 10.0
- TI-2001-00581 Netscape Communicator before 4.77 allows remote attackers to execute arbitrary Javascript… CVSS 2.0HIGH 7.5
- TI-2000-00674 Netscape Communicator and Navigator 4.04 through 4.74 allows remote attackers to read… CVSS 2.0MEDIUM 5.0
- TI-1999-00528 A configuration in a web browser such as Internet Explorer or Netscape Navigator allows… CVSS 2.0HIGH 7.5
- TI-2002-00577 Buffer overflow in Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to… CVSS 2.0HIGH 7.5
Sources
- CVE-1999-1262 · CVE Program
- CVE-1999-1262 · NVD
- FIRST EPSS
- GHSA-2ccq-2xr5-3q62 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences