PT-2008-6476 · Oracle · Java Runtime Environment+1

Published 2008-12-05 · Updated 2017-09-29 · CVE-2008-5352

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 16 Java Runtime Environment (JRE) versions 6 through 6 Update 10

Description The issue is related to an integer overflow in the JAR unpacking utility, which can be exploited by untrusted applications and applets to gain privileges. This can be achieved through a Pack200 compressed JAR file that triggers a heap-based buffer overflow.

Recommendations For Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 16, update to a version later than 5.0 Update 16 to resolve the issue. For Java Runtime Environment (JRE) versions 6 through 6 Update 10, update to a version later than 6 Update 10 to resolve the issue.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-5352

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0015

RHSA-2009:0016

RHSA-2009:0466

Affected Products

Java Platform

Java Runtime Environment

References · 29

• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5352 · Security Note
• http://security.gentoo.org/glsa/glsa-200911-02.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2008-1025.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0015.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0016.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2008-1018.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-244992-1 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-0466.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5352 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6383 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=759 · Note
• http://vupen.com/english/advisories/2008/3339 · Note
• http://secunia.com/advisories/32991 · Note