PT-2008-6470 · Oracle · Java Runtime Environment

Publicado 2008-12-05 · Atualizado 2019-07-31 · CVE-2008-5346

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 5.0 Update 16 and earlier Java Runtime Environment (JRE) versions 1.4.2 18 and earlier Java Runtime Environment (JRE) versions 1.3.1 23 or earlier

Description The issue allows untrusted applets and applications to read arbitrary memory via a crafted ZIP file. This is a result of an unspecified vulnerability in the Java Runtime Environment.

Recommendations For Java Runtime Environment (JRE) versions 5.0 Update 16 and earlier, update to a version later than 5.0 Update 16. For Java Runtime Environment (JRE) versions 1.4.2 18 and earlier, update to a version later than 1.4.2 18. For Java Runtime Environment (JRE) versions 1.3.1 23 or earlier, update to a version later than 1.3.1 23.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-5346

RHSA-2008:1025

RHSA-2009:0016

RHSA-2009:0445

RHSA-2009:0466

Produtos afetados

Java Runtime Environment

Referências · 27

• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6629 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5346 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-246386-1 · Aviso do Fabricante
• http://secunia.com/advisories/35065 · Nota
• http://vupen.com/english/advisories/2008/3339 · Nota
• http://secunia.com/advisories/32991 · Nota
• http://security.gentoo.org/glsa/glsa-200911-02.xml · Aviso do Fabricante
• http://secunia.com/advisories/34605 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5346 · Nota de Segurança
• http://securitytracker.com/id?1021306 · Nota
• http://rhn.redhat.com/errata/RHSA-2008-1025.html · Aviso do Fabricante
• http://secunia.com/advisories/33710 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Aviso do Fabricante
• http://osvdb.org/50507 · Nota