CVE-2008-5343 — JDK vulnerability

6 documents5 sources

Severity

9.0CRITICALNVD

EPSS

5.0%

top 10.23%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

SUN JDK SUN JRE SUN SDK

Timeline

PublishedDec 5

Latest updateMay 17

Description

Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR" and CR 6707535.

CVSS vector

AV:N/AC:L/C:C/I:P/A:PExploitability: 10.0 | Impact: 8.5

Affected Packages3 packages

▶NVDsun/jdk5.0+3

▶NVDsun/jre1.4.2_18+21

▶NVDsun/sdk1.4.2_18+17

Patches

Patch: sunsolve.sun.com ↗Patch: sunsolve.sun.com ↗

🔴Vulnerability Details

GHSA

GHSA-48xx-r45r-42qg: Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5↗2022-05-17

▶

CVEList

CVE-2008-5343: Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5↗2008-12-05

▶

📋Vendor Advisories

Red Hat

Java WebStart allows hidden code privilege escalation↗2008-12-04

▶

💬Community

Bugzilla

CVE-2013-1927 icedtea-web: GIFAR issue↗2012-12-06

▶

Bugzilla

CVE-2008-5343 Java WebStart allows hidden code privilege escalation↗2008-12-05

▶