PT-2008-6466 · Oracle+1 · Java Jre+4

Published 2008-12-05 · Updated 2017-09-29 · CVE-2008-5342

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Java JDK and JRE versions prior to 6 Update 11 Java JDK and JRE 5.0 versions prior to 5.0 Update 17 Java SDK and JRE 1.4.2 versions prior to 1.4.2 19

Description The issue allows untrusted downloaded applications to cause local files to be displayed in the user's browser via unknown vectors.

Recommendations For Java JDK and JRE 6 Update 10 and earlier, update to version 6 Update 11 or later. For Java JDK and JRE 5.0 Update 16 and earlier, update to version 5.0 Update 17 or later. For Java SDK and JRE 1.4.2 18 and earlier, update to version 1.4.2 19 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-5342

HPSBUX02411

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0016

RHSA-2009:0369

RHSA-2009:0445

Affected Products

Hp-Ux

Java Jdk

Java Jre

Java Platform

Java Sdk

References · 56

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-5342 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 · Security Note
• http://rhn.redhat.com/errata/RHSA-2008-1018.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5353 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5339 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=123678756409861&w=2 · Vendor Advisory