CVE-2008-5339

JavaWebStart allows unauthorized network connections

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to perform network connections to unauthorized hosts via unknown vectors, aka CR 6727079.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre and 1 more

CVE-2008-5340

Java WebStart privilege escalation

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to gain privileges to access local files or applications via unknown vectors, aka 6727081.

CVSS 2.0 · 10.0 Critical EPSS 3.8% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre and 1 more

CVE-2008-5341

Java Web Start exposes username and the pathname of the JWS cache

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted JWS applications to obtain the pathname of the JWS cache and the application username via unknown vectors, aka CR 6727071.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre and 1 more

CVE-2008-5342

Java Web Start BasicService displays local files in the browser

Unspecified vulnerability in the BasicService for Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted downloaded applications to cause local files to be displayed in the browser of the user of the untrusted application via unknown vectors, aka 6767668.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre and 1 more

CVE-2008-5343

Java WebStart allows hidden code privilege escalation

Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR" and CR 6707535.

CVSS 2.0 · 9.0 Critical EPSS 5.1% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre and 1 more

CVE-2008-5344

Java WebStart unprivileged local file and network access

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applets to read arbitrary files and make unauthorized network connections via unknown vectors related to applet classloading, aka 6716217.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre and 1 more

CVE-2008-5345

JRE allows unauthorized file access and connections to localhost

Unspecified vulnerability in Java Runtime Environment (JRE) with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier allows code that is loaded from a local filesystem to read arbitrary files and make unauthorized connections to localhost via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5346

JRE allows unauthorized memory read access via a crafted ZIP file

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 or earlier allows untrusted applets and applications to read arbitrary memory via a crafted ZIP file.

CVSS 2.0 · 7.1 High EPSS 2.8% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5347

OpenJDK applet privilege escalation via JAX package access (6592792)

Multiple unspecified vulnerabilities in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier allow untrusted applets and applications to gain privileges via vectors related to access to inner classes in the (1) JAX-WS and (2) JAXB packages.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jdk Jre

CVE-2008-5348

OpenJDK Denial-Of-Service in kerberos authentication (6588160)

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier, when using Kerberos authentication, allows remote attackers to cause a denial of service (OS resource consumption) via unknown vectors.

CVSS 2.0 · 7.1 High EPSS 4.3% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5349

OpenJDK RSA public key length denial-of-service (6497740)

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows remote attackers to cause a denial of service (CPU consumption) via a crafted RSA public key.

CVSS 2.0 · 7.1 High EPSS 4.0% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Rhel Extras Sap and 2 more

CVE-2008-5350

OpenJDK allows to list files within the user home directory (6484091)

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applications and applets to list the contents of the operating user's directory via unknown vectors.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5351

OpenJDK UTF-8 decoder accepts non-shortest form sequences (4486841)

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier accepts UTF-8 encodings that are not the "shortest" form, which makes it easier for attackers to bypass protection mechanisms for other applications that rely on shortest-form UTF-8 encodings.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5352

OpenJDK Jar200 Decompression buffer overflow (6755943)

Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 3.1% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 1 more

CVE-2008-5353

OpenJDK calendar object deserialization allows privilege escalation (6734167)

The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".

CVSS 2.0 · 10.0 Critical EPSS 86.1% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5354

OpenJDK Privilege escalation in command line applications (6733959)

Stack-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows locally-launched and possibly remote untrusted Java applications to execute arbitrary code via a JAR file with a long Main-Class manifest entry.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5355

JRE allows arbitrary code execution via DNS mitm attacks

The "Java Update" feature for Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the signature of the JRE that is downloaded, which allows remote attackers to execute arbitrary code via DNS man-in-the-middle attacks.

CVSS 2.0 · 10.0 Critical EPSS 8.2% KEV · Not listed

Vendors

Sun

Products

Jdk Jre Sdk

CVE-2008-5356

OpenJDK Font processing vulnerability (6733336)

Heap-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file.

CVSS 2.0 · 9.3 Critical EPSS 8.9% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2008-5357

OpenJDK Truetype Font processing vulnerability (6751322)

Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file, which triggers a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 10.0% KEV · Not listed

Vendors

Redhat Sun

Products

Network Satellite Rhel Extras Jdk and 2 more

CVE-2009-3729

JRE TrueType font parsing crash (6815780)

Unspecified vulnerability in the TrueType font parsing functionality in Sun Java SE 5.0 before Update 22 and 6 before Update 17 allows remote attackers to cause a denial of service (application crash) via a certain test suite, aka Bug Id 6815780.

CVSS 2.0 · 5.0 Medium EPSS 2.5% KEV · Not listed

Vendors

Redhat Sun

Products

Rhel Extras Jre