PT-2008-6482 · Sun+2 · Java Runtime Environment+2

Published 2008-12-05 · Updated 2017-09-29 · CVE-2008-5358

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) for Sun JDK and JRE versions 6 Update 10 and earlier

Description The issue allows remote attackers to execute arbitrary code via a crafted GIF file, triggering memory corruption during the display of the splash screen, possibly related to splashscreen.dll.

Recommendations For Java Runtime Environment (JRE) for Sun JDK and JRE versions 6 Update 10 and earlier, update to a version later than 6 Update 10 to resolve the issue.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-5358

HPSBUX02411

RHSA-2008:1018

RHSA-2009:0369

Affected Products

Hp-Ux

Java Platform

Java Runtime Environment

References · 53

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-244987-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2008-1018.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5358 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5353 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5339 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=123678756409861&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5358 · Security Note