CVE-2008-5360

OpenJDK temporary files have guessable file names (6721753)

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier creates temporary files with predictable file names, which allows attackers to write malicious JAR files via unknown vectors.

CVSS 2.0 · 6.4 Medium EPSS 3.5% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2007-6244

flash: XSS via asfunction protocol

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.

CVSS 2.0 · 4.3 Medium EPSS 12.9% KEV · Not listed

Vendors

Adobe Redhat

Products

Flash Player Rhel Extras

CVE-2008-5359

OpenJDK Buffer overflow in image processing (6726779)

Buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code, related to a ConvolveOp operation in the Java AWT library.

CVSS 2.0 · 9.3 Critical EPSS 10.8% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5358

OpenJDK Buffer Overflow in GIF image processing (6766136)

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier might allow remote attackers to execute arbitrary code via a crafted GIF file that triggers memory corruption during display of the splash screen, possibly related to splashscreen.dll.

CVSS 2.0 · 9.3 Critical EPSS 7.5% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre

CVE-2007-6243

Flash Player cross-domain and cross-site scripting flaws

Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.

CVSS 2.0 · 9.3 Critical EPSS 8.5% KEV · Not listed

Vendors

Adobe Redhat

Products

Flash Player Rhel Extras

CVE-2008-5357

OpenJDK Truetype Font processing vulnerability (6751322)

Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file, which triggers a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 10.0% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2006-6736

security flaw

Unspecified vulnerability in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 6 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allows attackers to use untrusted applets to "access data in other applets," aka "The second issue."

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Rhel Extras Jdk and 2 more

CVE-2008-5356

OpenJDK Font processing vulnerability (6733336)

Heap-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file.

CVSS 2.0 · 9.3 Critical EPSS 8.9% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2007-6242

flash: abitrary code execution

Unspecified vulnerability in Adobe Flash Player 9.0.48.0 and earlier might allow remote attackers to execute arbitrary code via unknown vectors, related to "input validation errors."

CVSS 2.0 · 6.8 Medium EPSS 30.1% KEV · Not listed

Vendors

Adobe Redhat

Products

Flash Player Rhel Extras

CVE-2008-5354

OpenJDK Privilege escalation in command line applications (6733959)

Stack-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows locally-launched and possibly remote untrusted Java applications to execute arbitrary code via a JAR file with a long Main-Class manifest entry.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5353

OpenJDK calendar object deserialization allows privilege escalation (6734167)

The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".

CVSS 2.0 · 10.0 Critical EPSS 86.1% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2007-6019

Flash Player input validation error

Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a modified DeclareFunction2 Actionscript tag, which prevents an object from being instantiated properly.

CVSS 2.0 · 9.3 Critical EPSS 59.8% KEV · Not listed

Vendors

Adobe Redhat

Products

Air Flash Flash Player and 2 more

CVE-2008-5352

OpenJDK Jar200 Decompression buffer overflow (6755943)

Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 3.1% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2006-6731

security flaw

Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allow attackers to develop Java applets that read, write, or execute local files, possibly related to (1) integer overflows in the Java_sun_awt_image_ImagingLib_convolveBI, awt_parseRaster, and awt_parseColorModel functions; (2) a stack overflow in the Java_sun_awt_image_ImagingLib_lookupByteRaster function; and (3) improper handling of certain negative values in the Java_sun_font_SunLayoutEngine_nativeLayout function. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 9.3 Critical EPSS 3.8% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Rhel Extras Jdk and 2 more

CVE-2008-5351

OpenJDK UTF-8 decoder accepts non-shortest form sequences (4486841)

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier accepts UTF-8 encodings that are not the "shortest" form, which makes it easier for attackers to bypass protection mechanisms for other applications that rely on shortest-form UTF-8 encodings.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2007-5689

java-jre: Applet Privilege Escalation

The Java Virtual Machine (JVM) in Sun Java Runtime Environment (JRE) in SDK and JRE 1.3.x through 1.3.1_20 and 1.4.x through 1.4.2_15, and JDK and JRE 5.x through 5.0 Update 12 and 6.x through 6 Update 2, allows remote attackers to execute arbitrary programs, or read or modify arbitrary files, via applets that grant privileges to themselves.

CVSS 2.0 · 10.0 Critical EPSS 4.9% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre and 1 more

CVE-2008-5350

OpenJDK allows to list files within the user home directory (6484091)

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applications and applets to list the contents of the operating user's directory via unknown vectors.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5349

OpenJDK RSA public key length denial-of-service (6497740)

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows remote attackers to cause a denial of service (CPU consumption) via a crafted RSA public key.

CVSS 2.0 · 7.1 High EPSS 4.0% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 2 more

CVE-2009-3959

acroread: multiple code execution flaws (APSB10-02)

Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.

CVSS 2.0 · 10.0 Critical EPSS 11.5% KEV · Not listed

Vendors

Adobe Apple Microsoft and 2 more

Products

Acrobat Acrobat Reader Mac Os X and 3 more

CVE-2007-5666

acroread JavaScript Insecure Libary Search Path

Untrusted search path vulnerability in Adobe Reader and Acrobat 8.1.1 and earlier allows local users to execute arbitrary code via a malicious Security Provider library in the reader's current working directory. NOTE: this issue might be subsumed by CVE-2008-0655.

CVSS 2.0 · 6.2 Medium EPSS 1.4% KEV · Not listed

Vendors

Adobe Redhat

Products

Acrobat Acrobat Reader Rhel Extras