CVE-2008-3112 Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbi...
HighCVSS 10.0
EPSS 25.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun jdk | <= 5.0 | No fix listed |
| sun jdk | <= 6 | No fix listed |
| sun jdk | = 5.0-update_10 | No fix listed |
| sun jdk | = 5.0-update_11 | No fix listed |
| sun jdk | = 5.0-update_12 | No fix listed |
| sun jdk | = 5.0-update_13 | No fix listed |
| sun jdk | = 5.0-update_14 | No fix listed |
| sun jdk | = 5.0-update_2 | No fix listed |
| sun jdk | = 5.0-update_3 | No fix listed |
| sun jdk | = 5.0-update_4 | No fix listed |
| sun jdk | = 5.0-update_5 | No fix listed |
| sun jdk | = 5.0-update_6 | No fix listed |
| sun jdk | = 5.0-update_7 | No fix listed |
| sun jdk | = 5.0-update_8 | No fix listed |
| sun jdk | = 5.0-update_9 | No fix listed |
| sun jdk | = 6-update_1 | No fix listed |
| sun jdk | = 6-update_2 | No fix listed |
| sun jdk | = 6-update_3 | No fix listed |
| sun jdk | = 6-update_4 | No fix listed |
| sun jdk | = 6-update_5 | No fix listed |
| sun jre | <= 1.4.2_17 | No fix listed |
| sun jre | <= 5.0 | No fix listed |
| sun jre | <= 6 | No fix listed |
| sun jre | = 1.4.2 | No fix listed |
| sun jre | = 1.4.2_01 | No fix listed |
Show 52 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sun jre | = 1.4.2_02 | No fix listed |
| sun jre | = 1.4.2_03 | No fix listed |
| sun jre | = 1.4.2_04 | No fix listed |
| sun jre | = 1.4.2_05 | No fix listed |
| sun jre | = 1.4.2_06 | No fix listed |
| sun jre | = 1.4.2_07 | No fix listed |
| sun jre | = 1.4.2_8 | No fix listed |
| sun jre | = 1.4.2_9 | No fix listed |
| sun jre | = 1.4.2_10 | No fix listed |
| sun jre | = 1.4.2_11 | No fix listed |
| sun jre | = 1.4.2_12 | No fix listed |
| sun jre | = 1.4.2_13 | No fix listed |
| sun jre | = 1.4.2_14 | No fix listed |
| sun jre | = 1.4.2_15 | No fix listed |
| sun jre | = 1.4.2_16 | No fix listed |
| sun jre | = 5.0-update_1 | No fix listed |
| sun jre | = 5.0-update_10 | No fix listed |
| sun jre | = 5.0-update_11 | No fix listed |
| sun jre | = 5.0-update_12 | No fix listed |
| sun jre | = 5.0-update_13 | No fix listed |
| sun jre | = 5.0-update_14 | No fix listed |
| sun jre | = 5.0-update_2 | No fix listed |
| sun jre | = 5.0-update_3 | No fix listed |
| sun jre | = 5.0-update_4 | No fix listed |
| sun jre | = 5.0-update_5 | No fix listed |
| sun jre | = 5.0-update_6 | No fix listed |
| sun jre | = 5.0-update_7 | No fix listed |
| sun jre | = 5.0-update_8 | No fix listed |
| sun jre | = 5.0-update_9 | No fix listed |
| sun jre | = 6-update_1 | No fix listed |
| sun jre | = 6-update_2 | No fix listed |
| sun jre | = 6-update_3 | No fix listed |
| sun jre | = 6-update_4 | No fix listed |
| sun jre | = 6-update_5 | No fix listed |
| sun sdk | = 1.4.2 | No fix listed |
| sun sdk | = 1.4.2_01 | No fix listed |
| sun sdk | = 1.4.2_02 | No fix listed |
| sun sdk | = 1.4.2_03 | No fix listed |
| sun sdk | = 1.4.2_04 | No fix listed |
| sun sdk | = 1.4.2_05 | No fix listed |
| sun sdk | = 1.4.2_06 | No fix listed |
| sun sdk | = 1.4.2_07 | No fix listed |
| sun sdk | = 1.4.2_08 | No fix listed |
| sun sdk | = 1.4.2_09 | No fix listed |
| sun sdk | = 1.4.2_10 | No fix listed |
| sun sdk | = 1.4.2_11 | No fix listed |
| sun sdk | = 1.4.2_12 | No fix listed |
| sun sdk | = 1.4.2_13 | No fix listed |
| sun sdk | = 1.4.2_14 | No fix listed |
| sun sdk | = 1.4.2_15 | No fix listed |
| sun sdk | = 1.4.2_16 | No fix listed |
| sun sdk | = 1.4.2_17 | No fix listed |
References
- APPLE-SA-2008-09-24 vendor-advisory
- SUSE-SA:2008:042 vendor-advisory
- SUSE-SA:2008:043 vendor-advisory
- SUSE-SA:2008:045 vendor-advisory
- SUSE-SR:2008:028 vendor-advisory
- SUSE-SR:2009:010 vendor-advisory
- 20081004 VMSA-2008-0016 VMware Hosted products, VirtualCenter Update 3 and mailing-list
- RHSA-2008:0955 vendor-advisory
- 31010 third-party-advisory vendor-advisory
- 31055 third-party-advisory
- 31320 third-party-advisory
- 31497 third-party-advisory
- 31600 third-party-advisory
- 31736 third-party-advisory
- 32018 third-party-advisory
- 32179 third-party-advisory
- 32180 third-party-advisory
- 32436 third-party-advisory
- 32826 third-party-advisory
- 33194 third-party-advisory
- 35065 third-party-advisory
- 37386 third-party-advisory
- GLSA-200911-02 vendor-advisory
- 238905 patch vendor-advisory
- support.apple.com
- support.apple.com
- support.avaya.com
- RHSA-2008:0594 vendor-advisory
- RHSA-2008:0595 vendor-advisory
- RHSA-2008:0790 vendor-advisory
- RHSA-2008:0906 vendor-advisory
- 20081004 VMSA-2008-0016 VMware Hosted products, VirtualCenter Update 3 and patches for ESX and ESXi resolve multiple security issues mailing-list
- 30148 vdb-entry
- 1020452 vdb-entry
- TA08-193A third-party-advisory us-government-resource
- www.vmware.com
- ADV-2008-2056 vdb-entry
- ADV-2008-2740 vdb-entry
- www.zerodayinitiative.com
- sun-javawebstart-file-create(43666) vdb-entry
- oval:org.mitre.oval:def:11102 signature vdb-entry