PT-2008-6483 · Oracle+1 · Java Awt+3

Published 2008-12-05 · Updated 2019-10-09 · CVE-2008-5359

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 6 Update 10 and earlier Java Runtime Environment (JRE) versions 5.0 Update 16 and earlier Java Runtime Environment (JRE) versions 1.4.2 18 and earlier Java Runtime Environment (JRE) versions 1.3.1 23 and earlier

Description The issue is related to a buffer overflow in the Java Runtime Environment, potentially allowing remote attackers to execute arbitrary code. This is connected to a ConvolveOp operation in the Java AWT library and image processing code.

Recommendations For Java Runtime Environment (JRE) versions 6 Update 10 and earlier, update to a version later than Update 10. For Java Runtime Environment (JRE) versions 5.0 Update 16 and earlier, update to a version later than Update 16. For Java Runtime Environment (JRE) versions 1.4.2 18 and earlier, update to a version later than 1.4.2 18. For Java Runtime Environment (JRE) versions 1.3.1 23 and earlier, update to a version later than 1.3.1 23.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-5359

HPSBUX02411

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0015

RHSA-2009:0016

RHSA-2009:0445

RHSA-2009:0466

Affected Products

Hp-Ux

Java Awt

Java Platform

Java Runtime Environment

References · 63

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0015.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-244987-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2008-1018.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-0466.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5353 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html · Vendor Advisory