CVE-2006-5201: Sun JDK

Medium severity, CVSS 4.0. EPSS: 3.4% chance of exploitation in the next 30 days.

Multiple packages on Sun Solaris, including (1) NSS; (2) Java JDK and JRE 5.0 Update 8 and earlier, SDK and JRE 1.4.x up to 1.4.2_12, and SDK and JRE 1.3.x up to 1.3.1_19; (3) JSSE 1.0.3_03 and earlier; (4) IPSec/IKE; (5) Secure Global Desktop; and (6) StarOffice, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents these products from correctly verifying X.509 and other certificates that use PKCS #1.

Affected products

• Sun JDK: version 1.5.0 only
• Sun JRE: version 1.3.1 only; version 1.3.1_2 only; version 1.3.1_03 only; version 1.3.1_04 only; version 1.3.1_05 only; version 1.3.1_06 only; …
• Sun Jsse: version 1.0.3 only; version 1.0.3_01 only; version 1.0.3_02 only; version 1.0.3_03 only
• Sun Nss: any version
• Sun SDK: version 1.3.1 only; version 1.3.1_01 only; version 1.3.1_01a only; version 1.3.1_02 only; version 1.3.1_03 only; version 1.3.1_04 only; …
• Sun Secure Global Desktop: any version
• Sun Solaris: version 9.0 only; version 10.0 only
• Sun Staroffice: any version
• Sun Sunos: version 5.8 only

Published 2006-10-10. Last modified 2026-06-16.