CVE-2008-5351

Aliases:CGA-2q65-2926-6j8hCGA-2xg8-jg6q-59rgCGA-364w-2r95-qp3hCGA-36wf-4rxr-4vg7CGA-37mh-wjxv-rwrqCGA-39w9-68qq-p6qcCGA-3m3m-4frq-mrc9CGA-3vg4-c92x-39gpCGA-46px-3pp7-m7mfCGA-474q-x44v-mr7hCGA-56g4-mh2q-rf73CGA-57vh-4vm8-8mxpCGA-57w3-h8wc-rgpcCGA-584q-pfh2-pg7gCGA-6838-x6v7-7x97CGA-692p-fgxh-h6c5CGA-6f43-7h46-jw94CGA-6v6h-6mrh-xf7xCGA-6xhq-g95h-v58jCGA-72h7-6m5h-4j77CGA-73h3-cxqr-cjmpCGA-76hf-42q5-45xxCGA-7q2q-7fw8-5832CGA-7r64-28hm-r769CGA-85jw-mvwx-q3rgCGA-8f35-8v7w-gjq7CGA-8hhm-7837-2gwqCGA-925g-v6cm-49hqCGA-94gv-5hj5-5487CGA-9797-7g36-hjhrCGA-9fww-rjxc-p4pjCGA-9jvf-4hc4-775wCGA-9qqj-4pxg-892cCGA-c2hw-2fm4-6r36CGA-ch67-q8c6-6hwvCGA-cmpp-hgpm-9jp2CGA-cpvv-xvgg-pgppCGA-f35x-3994-8qwgCGA-fm8c-j5wp-4794CGA-g4w4-4725-mxjpCGA-g73w-p7xg-9m2xCGA-h5m7-xqg9-3gc3CGA-hr77-f9rp-gphwCGA-hvfm-4crr-wx9mCGA-j5h5-7wfm-rxm5CGA-j5mf-r38f-mvrcCGA-jjm8-m4r9-p39vCGA-jr8v-85h5-xffmCGA-m67w-7cfh-fmvxCGA-m7h2-jw32-g5mjCGA-mc75-wv3v-g4q3CGA-mfj3-37m8-cg93CGA-mg7c-6mj6-xh52CGA-mpwx-g8qx-6p59CGA-ph7p-79vj-ffqqCGA-pj49-cp29-5wcxCGA-pjx9-6g77-xc8rCGA-px32-fqqf-pw66CGA-q4pq-29w5-8g4mCGA-q67r-x98x-rw5rCGA-qv6c-78c2-7xc8CGA-qw36-r6rw-55r3CGA-r3qw-g2m2-h2vqCGA-r67c-jjmc-w68mCGA-rpq6-f765-4jx3CGA-rw38-fmqm-7rfvCGA-v3mp-fgpw-68fhCGA-v8vv-659x-qvxrCGA-vfqj-xx6x-rgf7CGA-w5m5-h3hv-748cCGA-wm9q-vq88-hw97CGA-wr66-cpg4-w3vfCGA-wrvx-f3mp-5p8jCGA-x9hp-5rwx-v8vgCGA-xffr-3cr3-57vqCGA-xgfh-5m7v-gxqwCGA-xm66-5584-whphCGA-xw8g-rjgv-qv9j
Advisory lineage Upstream: 0 Downstream: 6
Modified
Published: 05 Dec 2008, 11:00
Last modified:07 Aug 2024, 10:49

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.5 HIGH
v2.0 (nvd)
EPSS Score
3.43% LOW
3% probability +0.15%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Dec 2008, 11:00
Published
Vulnerability first disclosed
07 Aug 2024, 10:49
Last Modified
Vulnerability information updated

Description

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier accepts UTF-8 encodings that are not the "shortest" form, which makes it easier for attackers to bypass protection mechanisms for other applications that rely on shortest-form UTF-8 encodings.

CVSS Metrics

  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 3.43%• Percentile: 88%

Techniques & Countermeasures

  • CWE-264•Permissions, Privileges, and Access Controls

    Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected Systems

  • chainguard•openjdk-11-openj9

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-dbg

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-default-jdk

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-default-jvm

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-doc

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-jmods

    < 0.59.0-r2

  • chainguard•openjdk-11-openj9-jre

    < 0.59.0-r2

  • chainguard•openjdk-17-openj9

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-dbg

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-default-jdk

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-default-jvm

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-doc

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-jmods

    < 0.59.0-r1

  • chainguard•openjdk-17-openj9-jre

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-dbg

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-default-jdk

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-default-jvm

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-doc

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-jmods

    < 0.59.0-r1

  • chainguard•openjdk-21-openj9-jre

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9-dbg

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9-default-jdk

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9-default-jvm

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9-jmods

    < 0.59.0-r1

  • chainguard•openjdk-25-openj9-jre

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9-dbg

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9-default-jdk

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9-default-jvm

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9-jmods

    < 0.59.0-r1

  • chainguard•openjdk-26-openj9-jre

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9-dbg

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9-default-jdk

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9-default-jvm

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9-doc

    < 0.59.0-r1

  • chainguard•openjdk-8-openj9-jre

    < 0.59.0-r1

  • sun•jdk

    ≤ 5.0 | ≤ 6 | 5.0:update_1 | 5.0:update_10 | 5.0:update_11 | 5.0:update_12 | 5.0:update_13 | 5.0:update_14 | 5.0:update_15 | 5.0:update_2 | 5.0:update_3 | 5.0:update_4 | 5.0:update_5 | 5.0:update_6 | 5.0:update_7 | 5.0:update_8 | 5.0:update_9 | 6 | 6:update_1 | 6:update_2 | 6:update_3 | 6:update_4 | 6:update_5 | 6:update_6 | 6:update_7 | 6:update_8 | 6:update_9

  • sun•jre

    ≤ 1.4.2_18 | ≤ 5.0 | ≤ 6 | 1.4.2_1 | 1.4.2_2 | 1.4.2_3 | 1.4.2_4 | 1.4.2_5 | 1.4.2_6 | 1.4.2_7 | 1.4.2_8 | 1.4.2_9 | 1.4.2_10 | 1.4.2_11 | 1.4.2_12 | 1.4.2_13 | 1.4.2_14 | 1.4.2_15 | 1.4.2_16 | 1.4.2_17 | 5.0 | 5.0:update_1 | 5.0:update_10 | 5.0:update_11 | 5.0:update_12 | 5.0:update_13 | 5.0:update_14 | 5.0:update_15 | 5.0:update_2 | 5.0:update_3 | 5.0:update_4 | 5.0:update_5 | 5.0:update_6 | 5.0:update_7 | 5.0:update_8 | 5.0:update_9 | 6 | 6:update_1 | 6:update_2 | 6:update_3 | 6:update_4 | 6:update_5 | 6:update_6 | 6:update_7 | 6:update_8 | 6:update_9

  • sun•sdk

    ≤ 1.4.2_18 | 1.4.2_1 | 1.4.2_2 | 1.4.2_3 | 1.4.2_4 | 1.4.2_5 | 1.4.2_6 | 1.4.2_7 | 1.4.2_8 | 1.4.2_9 | 1.4.2_10 | 1.4.2_11 | 1.4.2_12 | 1.4.2_13 | 1.4.2_14 | 1.4.2_15 | 1.4.2_16 | 1.4.2_17

References (37)