CVE-2008-1196: sun jdk

CVSS: 6.8v2.0MediumModified

Published 06-03-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-1196 is a medium (CVSS 6.8) vulnerability in sun jdk. EPSS estimates a 7.26% chance of exploitation in the next 30 days, higher than 94.2% of scored vulnerabilities.

Overall risk

29/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

7.26%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5

RHSA-2008:0186 RHSA-2008:0210 RHSA-2008:0267 RHSA-2008:0555 RHSA-2008:0638

Timeline

06-03-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Stack-based buffer overflow in Java Web Start (javaws.exe) in Sun JDK and JRE 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to execute arbitrary code via a crafted JNLP file.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

7.26%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 7.26% on 18-09-2026

18-09-202618-10-2026

EPSS score

7.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Sun3 products

jdk1.5.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update2 | 1.5.0:update3 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update8 | 1.5.0:update9 | 1.6.0 | 1.6.0:update_3 | 1.6.0:update_4
jre1.4.2 | 1.4.2_1 | 1.4.2_2 | 1.4.2_3 | 1.4.2_4 | 1.4.2_5 | 1.4.2_6 | 1.4.2_7 | 1.4.2_8 | 1.4.2_9 | 1.4.2_10 | 1.4.2_11 | 1.4.2_12 | 1.4.2_13 | 1.4.2_14 | 1.4.2_15 | 1.4.2_16 | 1.5.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update2 | 1.5.0:update3 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update8 | 1.5.0:update9 | 1.6.0 | 1.6.0:update_1 | 1.6.0:update_2 | 1.6.0:update_3 | 1.6.0:update_4
sdk1.4.2 | 1.4.2_1 | 1.4.2_2 | 1.4.2_3 | 1.4.2_4 | 1.4.2_5 | 1.4.2_6 | 1.4.2_7 | 1.4.2_8 | 1.4.2_9 | 1.4.2_10 | 1.4.2_11 | 1.4.2_12 | 1.4.2_13 | 1.4.2_14 | 1.4.2_15 | 1.4.2_16

1 vendor · 3 products

References

36 links

lists.apple.com/archives/security-announce//2008/Sep/msg00008.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
secunia.com/advisories/30676Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0267.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.kb.cert.org/vuls/id/223028Third Party AdvisoryX Refsource CERT VNUS Government Resource
secunia.com/advisories/32018Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31586Third Party AdvisoryX Refsource SECUNIA
download.novell.com/Download?buildid=q5exhSqeBjA~X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/29897Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29498Third Party AdvisoryX Refsource SECUNIA

Show all 36 references

security.gentoo.org/glsa/glsa-200804-28.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
secunia.com/advisories/29239Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29858Third Party AdvisoryX Refsource SECUNIA
www.us-cert.gov/cas/techalerts/TA08-066A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
support.apple.com/kb/HT3178X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/29582Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/41026VDB EntryX Refsource XFThird Party Advisory
www.vupen.com/english/advisories/2008/0770/referencesVDB EntryX Refsource VUPENThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10412VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/31497Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-233327-1Vendor AdvisoryX Refsource SUNALERTPatchThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0210.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/31067Third Party AdvisoryX Refsource SECUNIA
support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5033642.htmlX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/30780Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/1856/referencesVDB EntryX Refsource VUPENThird Party Advisory
www.vmware.com/security/advisories/VMSA-2008-0010.htmlX Refsource CONFIRMThird Party Advisory
www.gentoo.org/security/en/glsa/glsa-200804-20.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.gentoo.org/security/en/glsa/glsa-200806-11.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.securitytracker.com/id?1019552VDB EntryX Refsource SECTRACKThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0186.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
support.apple.com/kb/HT3179X Refsource CONFIRMThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0555.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/31580Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29273Third Party AdvisoryX Refsource SECUNIA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities