CVE-2008-5357 — Improper Restriction of Operations within the Bounds of a Memory Buffer in JDK

CWE-1895 documents5 sources

Severity

9.3CRITICALNVD

EPSS

13.7%

top 5.74%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

SUN JDK SUN JRE SUN SDK

Timeline

PublishedDec 5

Latest updateMay 13

Description

Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file, which triggers a heap-based buffer overflow.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶NVDsun/jdk1.5.0, 1.6.0+1

▶NVDsun/jre44 versions+43

▶NVDsun/sdk49 versions+48

Patches

Patch: labs.idefense.com ↗Patch: sunsolve.sun.com ↗Patch: labs.idefense.com ↗

🔴Vulnerability Details

GHSA

GHSA-vwpw-5ffm-g9xg: Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5↗2022-05-13

▶

CVEList

CVE-2008-5357: Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5↗2008-12-05

▶

📋Vendor Advisories

Red Hat

OpenJDK Truetype Font processing vulnerability (6751322)↗2008-12-04

▶

💬Community

Bugzilla

CVE-2008-5357 OpenJDK Truetype Font processing vulnerability (6751322)↗2008-11-19

▶