Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-1193 — JDK vulnerability

CWE-2648 documents6 sources

Severity

9.3CRITICALNVD

EPSS

37.4%

top 2.81%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

SUN JDK SUN JRE

Timeline

PublishedMar 6

Latest updateMay 1

Description

Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to gain privileges via an untrusted application.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDsun/jdk1.5.0, 1.6.0+1

▶NVDsun/jre1.5.0, 1.6.0+1

Patches

Patch: sunsolve.sun.com ↗Patch: sunsolve.sun.com ↗

🔴Vulnerability Details

GHSA

GHSA-85h9-hqf9-8hc6: Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5↗2022-05-01

▶

CVEList

CVE-2008-1193: Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5↗2008-03-06

▶

💥Exploits & PoCs

Exploit-DB

Sun Java Runtime Environment 1.x - Image Parsing Heap Buffer Overflow↗2008-03-06

▶

📋Vendor Advisories

Red Hat

dbus: invalid signatures verified as valid due to improper fix for CVE-2008-3834↗2015-02-06

▶

Red Hat

JRE image parsing library allows privilege escalation (CVE-2008-1194)↗2008-03-06

▶

💬Community

Bugzilla

CVE-2008-1193 JRE image parsing library allows privilege escalation (CVE-2008-1194)↗2008-03-06

▶