CVE-2008-3111 Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain priv...
HighCVSS 10.0
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun jdk | = 5.0-update_1 | No fix listed |
| sun jdk | = 5.0-update_10 | No fix listed |
| sun jdk | = 5.0-update_11 | No fix listed |
| sun jdk | = 5.0-update_12 | No fix listed |
| sun jdk | = 5.0-update_13 | No fix listed |
| sun jdk | = 5.0-update_14 | No fix listed |
| sun jdk | = 5.0-update_15 | No fix listed |
| sun jdk | = 5.0-update_2 | No fix listed |
| sun jdk | = 5.0-update_3 | No fix listed |
| sun jdk | = 5.0-update_4 | No fix listed |
| sun jdk | = 5.0-update_5 | No fix listed |
| sun jdk | = 5.0-update_6 | No fix listed |
| sun jdk | = 5.0-update_7 | No fix listed |
| sun jdk | = 5.0-update_8 | No fix listed |
| sun jdk | = 5.0-update_9 | No fix listed |
| sun jdk | = 6-update_1 | No fix listed |
| sun jdk | = 6-update_2 | No fix listed |
| sun jdk | = 6-update_3 | No fix listed |
| sun jre | = 1.4 | No fix listed |
| sun jre | = 1.4.2_01 | No fix listed |
| sun jre | = 1.4.2_02 | No fix listed |
| sun jre | = 1.4.2_03 | No fix listed |
| sun jre | = 1.4.2_04 | No fix listed |
| sun jre | = 1.4.2_05 | No fix listed |
| sun jre | = 1.4.2_06 | No fix listed |
Show 48 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sun jre | = 1.4.2_07 | No fix listed |
| sun jre | = 1.4.2_8 | No fix listed |
| sun jre | = 1.4.2_9 | No fix listed |
| sun jre | = 1.4.2_10 | No fix listed |
| sun jre | = 1.4.2_11 | No fix listed |
| sun jre | = 1.4.2_12 | No fix listed |
| sun jre | = 1.4.2_13 | No fix listed |
| sun jre | = 1.4.2_14 | No fix listed |
| sun jre | = 1.4.2_15 | No fix listed |
| sun jre | = 1.4.2_16 | No fix listed |
| sun jre | = 1.4.2_17 | No fix listed |
| sun jre | = 5.0-update_1 | No fix listed |
| sun jre | = 5.0-update_10 | No fix listed |
| sun jre | = 5.0-update_11 | No fix listed |
| sun jre | = 5.0-update_12 | No fix listed |
| sun jre | = 5.0-update_13 | No fix listed |
| sun jre | = 5.0-update_14 | No fix listed |
| sun jre | = 5.0-update_15 | No fix listed |
| sun jre | = 5.0-update_2 | No fix listed |
| sun jre | = 5.0-update_3 | No fix listed |
| sun jre | = 5.0-update_4 | No fix listed |
| sun jre | = 5.0-update_5 | No fix listed |
| sun jre | = 5.0-update_6 | No fix listed |
| sun jre | = 5.0-update_7 | No fix listed |
| sun jre | = 5.0-update_8 | No fix listed |
| sun jre | = 5.0-update_9 | No fix listed |
| sun jre | = 6-update_1 | No fix listed |
| sun jre | = 6-update_2 | No fix listed |
| sun jre | = 6-update_3 | No fix listed |
| sun sdk | = 1.4 | No fix listed |
| sun sdk | = 1.4.2 | No fix listed |
| sun sdk | = 1.4.2_01 | No fix listed |
| sun sdk | = 1.4.2_02 | No fix listed |
| sun sdk | = 1.4.2_03 | No fix listed |
| sun sdk | = 1.4.2_04 | No fix listed |
| sun sdk | = 1.4.2_05 | No fix listed |
| sun sdk | = 1.4.2_06 | No fix listed |
| sun sdk | = 1.4.2_07 | No fix listed |
| sun sdk | = 1.4.2_08 | No fix listed |
| sun sdk | = 1.4.2_09 | No fix listed |
| sun sdk | = 1.4.2_10 | No fix listed |
| sun sdk | = 1.4.2_11 | No fix listed |
| sun sdk | = 1.4.2_12 | No fix listed |
| sun sdk | = 1.4.2_13 | No fix listed |
| sun sdk | = 1.4.2_14 | No fix listed |
| sun sdk | = 1.4.2_15 | No fix listed |
| sun sdk | = 1.4.2_16 | No fix listed |
| sun sdk | = 1.4.2_17 | No fix listed |
References
- APPLE-SA-2008-09-24 vendor-advisory
- SUSE-SA:2008:042 vendor-advisory
- SUSE-SA:2008:043 vendor-advisory
- SUSE-SA:2008:045 vendor-advisory
- 20081004 VMSA-2008-0016 VMware Hosted products, VirtualCenter Update 3 and mailing-list
- 31010 third-party-advisory vendor-advisory
- 31055 third-party-advisory vendor-advisory
- 31320 third-party-advisory vendor-advisory
- 31497 third-party-advisory vendor-advisory
- 31600 third-party-advisory vendor-advisory
- 31736 third-party-advisory
- 32018 third-party-advisory vendor-advisory
- 32179 third-party-advisory vendor-advisory
- 32180 third-party-advisory vendor-advisory
- 37386 third-party-advisory vendor-advisory
- GLSA-200911-02 vendor-advisory
- 238905 patch vendor-advisory
- support.apple.com
- support.apple.com
- RHSA-2008:0595 vendor-advisory
- RHSA-2008:0790 vendor-advisory
- 20080717 ZDI-08-043: Sun Java Web Start vm args Stack Buffer Overflow mailing-list
- 20081004 VMSA-2008-0016 VMware Hosted products, VirtualCenter Update 3 and patches for ESX and ESXi resolve multiple security issues mailing-list
- 30148 vdb-entry
- 1020452 vdb-entry
- TA08-193A third-party-advisory us-government-resource
- www.vmware.com
- ADV-2008-2056 vdb-entry vendor-advisory
- ADV-2008-2740 vdb-entry vendor-advisory
- www.zerodayinitiative.com
- sun-javawebstart-unspecified-bo(43664) vdb-entry
- oval:org.mitre.oval:def:10541 signature vdb-entry