[Forgot Password]
Login  Register Subscribe

24003

 
 

131401

 
 

103942

 
 

909

 
 

84051

 
 

133

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2008-3111Date: (C)2008-07-09   (M)2018-02-19


Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : CVSS Score : 10.0
Exploit Score: Exploit Score: 10.0
Impact Score: Impact Score: 10.0
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: Access Vector: NETWORK
Attack Complexity: Access Complexity: LOW
Privileges Required: Authentication: NONE
User Interaction: Confidentiality: COMPLETE
Scope: Integrity: COMPLETE
Confidentiality: Availability: COMPLETE
Integrity:  
Availability:  
  
Reference:
SECTRACK-1020452
http://www.securityfocus.com/archive/1/archive/1/494505/100/0/threaded
http://marc.info/?l=bugtraq&m=122331139823057&w=2
http://www.securityfocus.com/archive/1/archive/1/497041/100/0/threaded
SUNALERT-238905
BID-30148
SECUNIA-31010
SECUNIA-31055
SECUNIA-31320
SECUNIA-31497
SECUNIA-31600
SECUNIA-31736
SECUNIA-32018
SECUNIA-32179
SECUNIA-32180
SECUNIA-37386
ADV-2008-2056
ADV-2008-2740
APPLE-SA-2008-09-24
GLSA-200911-02
IAVM:2012-A-0136
RHSA-2008:0595
RHSA-2008:0790
SUSE-SA:2008:042
SUSE-SA:2008:043
SUSE-SA:2008:045
TA08-193A
http://support.apple.com/kb/HT3178
http://support.apple.com/kb/HT3179
http://www.vmware.com/security/advisories/VMSA-2008-0016.html
http://www.zerodayinitiative.com/advisories/ZDI-08-043/
sun-javawebstart-unspecified-bo(43664)

CPE    24
cpe:/a:sun:jre:1.4.2:update15
cpe:/a:sun:jre:1.4.2:update12
cpe:/a:sun:jre:1.4.2:update10
cpe:/a:sun:jre:1.4.2:update11
...
CWE    1
CWE-20
OVAL    1
oval:org.secpod.oval:def:9222

© 2013 SecPod Technologies