Unrated severityNVD Advisory· Published Jul 9, 2008· Updated Jun 16, 2026
CVE-2008-3111
CVE-2008-3111
Description
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
74cpe:2.3:a:sun:jdk:5.0:update_1:*:*:*:*:*:*+ 17 more
- cpe:2.3:a:sun:jdk:5.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_11:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_12:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_13:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_14:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_15:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_2:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_6:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_7:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_8:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:5.0:update_9:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:6:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:6:update_2:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:6:update_3:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.4:*:*:*:*:*:*:*+ 35 more
- cpe:2.3:a:sun:jre:1.4:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_01:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_02:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_03:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_04:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_05:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_06:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_07:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_11:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_12:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_13:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_14:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_15:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_2:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_6:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_7:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_8:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:5.0:update_9:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:6:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:6:update_2:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:6:update_3:*:*:*:*:*:*
cpe:2.3:a:sun:sdk:1.4:*:*:*:*:*:*:*+ 18 more
- cpe:2.3:a:sun:sdk:1.4:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_01:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_02:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_03:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_04:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_05:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_06:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_07:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_08:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_09:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_10:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_11:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_12:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_13:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_14:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_15:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_16:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_17:*:*:*:*:*:*:*
- Range: <=6 Update 4, <=5.0 Update 16, <=1.4.2_18
Patches
Vulnerability mechanics
References
32- sunsolve.sun.com/search/document.donvdPatch
- secunia.com/advisories/31010nvdVendor Advisory
- secunia.com/advisories/31055nvdVendor Advisory
- secunia.com/advisories/31320nvdVendor Advisory
- secunia.com/advisories/31497nvdVendor Advisory
- secunia.com/advisories/31600nvdVendor Advisory
- secunia.com/advisories/32018nvdVendor Advisory
- secunia.com/advisories/32179nvdVendor Advisory
- secunia.com/advisories/32180nvdVendor Advisory
- secunia.com/advisories/37386nvdVendor Advisory
- www.vupen.com/english/advisories/2008/2056/referencesnvdVendor Advisory
- www.vupen.com/english/advisories/2008/2740nvdVendor Advisory
- www.us-cert.gov/cas/techalerts/TA08-193A.htmlnvdUS Government Resource
- lists.apple.com/archives/security-announce//2008/Sep/msg00008.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2008-09/msg00002.htmlnvd
- marc.infonvd
- secunia.com/advisories/31736nvd
- security.gentoo.org/glsa/glsa-200911-02.xmlnvd
- support.apple.com/kb/HT3178nvd
- support.apple.com/kb/HT3179nvd
- www.redhat.com/support/errata/RHSA-2008-0595.htmlnvd
- www.redhat.com/support/errata/RHSA-2008-0790.htmlnvd
- www.securityfocus.com/archive/1/494505/100/0/threadednvd
- www.securityfocus.com/archive/1/497041/100/0/threadednvd
- www.securityfocus.com/bid/30148nvd
- www.securitytracker.com/idnvd
- www.vmware.com/security/advisories/VMSA-2008-0016.htmlnvd
- www.zerodayinitiative.com/advisories/ZDI-08-043/nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/43664nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10541nvd
News mentions
0No linked articles in our index yet.