Java Web Start in Sun JDK and JRE 6 Update 2 and earlier JDK and JRE 5.0 Update 12 and earlier and SDK and JRE 1.4.2_15 and earlier does not properly enforce access restrictions for untrusted applications which allows user-assisted remote attackers to obtain sensitive information (the Java Web Start cache location) via an untrusted application aka \three vulnerabilities.\