CVE-2008-5357: Buffer Overflow
First published: Fri Dec 05 2008(Updated: )
Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file, which triggers a heap-based buffer overflow.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sun Java Runtime Environment (JRE) | =1.3.1 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_2 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_03 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_04 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_05 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_06 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_07 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_08 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_09 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_10 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_11 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_12 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_13 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_14 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_15 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_16 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_17 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_18 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_19 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_20 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_21 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_22 | |
| Sun Java Runtime Environment (JRE) | =1.3.1_23 | |
| Sun Java Runtime Environment (JRE) | =1.4.2 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_1 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_2 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_3 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_4 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_5 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_6 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_7 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_8 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_9 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_10 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_11 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_12 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_13 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_14 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_15 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_16 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_17 | |
| Sun Java Runtime Environment (JRE) | =1.4.2_18 | |
| Sun Java Runtime Environment (JRE) | =1.5.0 | |
| Sun Java Runtime Environment (JRE) | =1.5.0-update1 | |
| Sun Java Runtime Environment (JRE) | =1.5.0-update10 | |
| Sun Java Runtime Environment (JRE) | =1.5.0-update11 | |
| Sun Java Runtime Environment (JRE) | =1.5.0-update12 | |
| Sun Java Runtime Environment (JRE) | =1.5.0-update13 | |
| Sun Java Runtime Environment (JRE) | =1.5.0-update14 | |
| Sun Java Runtime Environment (JRE) | =1.5.0-update15 | |
| Sun Java Runtime Environment (JRE) | =1.5.0-update16 | |
| Sun Java Runtime Environment (JRE) | =1.5.0-update2 | |
| Sun Java Runtime Environment (JRE) | =1.6.0 | |
| Sun Java Runtime Environment (JRE) | =1.6.0-update_1 | |
| Sun Java Runtime Environment (JRE) | =1.6.0-update_10 | |
| Sun Java Runtime Environment (JRE) | =1.6.0-update_2 | |
| Sun Java Runtime Environment (JRE) | =1.6.0-update_3 | |
| Sun Java Runtime Environment (JRE) | =1.6.0-update_4 | |
| Sun Java Runtime Environment (JRE) | =1.6.0-update_5 | |
| Sun Java Runtime Environment (JRE) | =1.6.0-update_6 | |
| Java Development Kit (JDK) | =1.5.0 | |
| Java Development Kit (JDK) | =1.5.0-update1 | |
| Java Development Kit (JDK) | =1.5.0-update10 | |
| Java Development Kit (JDK) | =1.5.0-update2 | |
| Java Development Kit (JDK) | =1.5.0-update3 | |
| Java Development Kit (JDK) | =1.5.0-update4 | |
| Java Development Kit (JDK) | =1.5.0-update5 | |
| Java Development Kit (JDK) | =1.5.0-update6 | |
| Java Development Kit (JDK) | =1.5.0-update7 | |
| Java Development Kit (JDK) | =1.5.0-update7_b03 | |
| Java Development Kit (JDK) | =1.5.0-update8 | |
| Java Development Kit (JDK) | =1.5.0-update9 | |
| Java Development Kit (JDK) | =1.6.0 | |
| Java Development Kit (JDK) | =1.6.0-update_10 | |
| Java Development Kit (JDK) | =1.6.0-update_3 | |
| Java Development Kit (JDK) | =1.6.0-update_4 | |
| Java Development Kit (JDK) | =1.6.0-update_5 | |
| Java Development Kit (JDK) | =1.6.0-update_6 | |
| Java Development Kit (JDK) | =1.6.0-update_7 | |
| Java Development Kit (JDK) | =1.3.1 | |
| Java Development Kit (JDK) | =1.3.1_01 | |
| Java Development Kit (JDK) | =1.3.1_01a | |
| Java Development Kit (JDK) | =1.3.1_02 | |
| Java Development Kit (JDK) | =1.3.1_03 | |
| Java Development Kit (JDK) | =1.3.1_04 | |
| Java Development Kit (JDK) | =1.3.1_05 | |
| Java Development Kit (JDK) | =1.3.1_06 | |
| Java Development Kit (JDK) | =1.3.1_07 | |
| Java Development Kit (JDK) | =1.3.1_08 | |
| Java Development Kit (JDK) | =1.3.1_09 | |
| Java Development Kit (JDK) | =1.3.1_10 | |
| Java Development Kit (JDK) | =1.3.1_11 | |
| Java Development Kit (JDK) | =1.3.1_12 | |
| Java Development Kit (JDK) | =1.3.1_13 | |
| Java Development Kit (JDK) | =1.3.1_14 | |
| Java Development Kit (JDK) | =1.3.1_15 | |
| Java Development Kit (JDK) | =1.3.1_16 | |
| Java Development Kit (JDK) | =1.3.1_17 | |
| Java Development Kit (JDK) | =1.3.1_18 | |
| Java Development Kit (JDK) | =1.3.1_19 | |
| Java Development Kit (JDK) | =1.3.1_20 | |
| Java Development Kit (JDK) | =1.3.1_21 | |
| Java Development Kit (JDK) | =1.3.1_22 | |
| Java Development Kit (JDK) | =1.3.1_23 | |
| Java Development Kit (JDK) | =1.4.2 | |
| Java Development Kit (JDK) | =1.4.2_1 | |
| Java Development Kit (JDK) | =1.4.2_2 | |
| Java Development Kit (JDK) | =1.4.2_02 | |
| Java Development Kit (JDK) | =1.4.2_03 | |
| Java Development Kit (JDK) | =1.4.2_3 | |
| Java Development Kit (JDK) | =1.4.2_04 | |
| Java Development Kit (JDK) | =1.4.2_4 | |
| Java Development Kit (JDK) | =1.4.2_5 | |
| Java Development Kit (JDK) | =1.4.2_6 | |
| Java Development Kit (JDK) | =1.4.2_7 | |
| Java Development Kit (JDK) | =1.4.2_8 | |
| Java Development Kit (JDK) | =1.4.2_08 | |
| Java Development Kit (JDK) | =1.4.2_09 | |
| Java Development Kit (JDK) | =1.4.2_9 | |
| Java Development Kit (JDK) | =1.4.2_10 | |
| Java Development Kit (JDK) | =1.4.2_11 | |
| Java Development Kit (JDK) | =1.4.2_12 | |
| Java Development Kit (JDK) | =1.4.2_13 | |
| Java Development Kit (JDK) | =1.4.2_14 | |
| Java Development Kit (JDK) | =1.4.2_15 | |
| Java Development Kit (JDK) | =1.4.2_16 | |
| Java Development Kit (JDK) | =1.4.2_17 | |
| Java Development Kit (JDK) | =1.4.2_18 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=760
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-244987-1
- http://rhn.redhat.com/errata/RHSA-2008-1025.html
- http://secunia.com/advisories/33015
- http://secunia.com/advisories/32991
- http://rhn.redhat.com/errata/RHSA-2008-1018.html
- http://www.securityfocus.com/bid/32608
- http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html
- http://www.us-cert.gov/cas/techalerts/TA08-340A.html
- http://secunia.com/advisories/33710
- http://secunia.com/advisories/33187
- http://support.avaya.com/elmodocs2/security/ASA-2008-485.htm
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
- http://support.avaya.com/elmodocs2/security/ASA-2009-012.htm
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid=
- http://www.redhat.com/support/errata/RHSA-2009-0016.html
- http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-01.pdf
- http://secunia.com/advisories/34233
- http://secunia.com/advisories/34259
- http://www.vupen.com/english/advisories/2009/0672
- http://marc.info/?l=bugtraq&m=123678756409861&w=2
- http://secunia.com/advisories/34447
- http://www.redhat.com/support/errata/RHSA-2009-0369.html
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
- http://secunia.com/advisories/34605
- http://secunia.com/advisories/35065
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
- http://secunia.com/advisories/34972
- https://rhn.redhat.com/errata/RHSA-2009-0466.html
- http://osvdb.org/50517
- http://security.gentoo.org/glsa/glsa-200911-02.xml
- http://secunia.com/advisories/37386
- http://secunia.com/advisories/38539
- http://www.vupen.com/english/advisories/2008/3339
- http://marc.info/?l=bugtraq&m=126583436323697&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47050
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6505
Frequently Asked Questions
What is the severity of CVE-2008-5357?
The severity of CVE-2008-5357 is considered high due to its potential for remote code execution.
How can I mitigate CVE-2008-5357?
Mitigation for CVE-2008-5357 includes updating to the latest version of the Java Runtime Environment (JRE) or applying patches provided by the vendor.
What versions are affected by CVE-2008-5357?
CVE-2008-5357 affects Sun JDK and JRE versions prior to update 11 of 6, update 16 of 5.0, and various earlier versions of 1.4.2 and 1.3.1.
What type of attack does CVE-2008-5357 allow?
CVE-2008-5357 allows remote attackers to execute arbitrary code by exploiting an integer overflow associated with a crafted TrueType font file.
Is a workaround available for CVE-2008-5357?
No official workarounds for CVE-2008-5357 are documented; the recommended solution is to update or patch the affected environment.
- agent/remedy
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/author
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/sun
- canonical/sun java runtime environment (jre)
- version/sun java runtime environment (jre)/1.3.1
- version/sun java runtime environment (jre)/1.3.1_2
- version/sun java runtime environment (jre)/1.3.1_03
- version/sun java runtime environment (jre)/1.3.1_04
- version/sun java runtime environment (jre)/1.3.1_05
- version/sun java runtime environment (jre)/1.3.1_06
- version/sun java runtime environment (jre)/1.3.1_07
- version/sun java runtime environment (jre)/1.3.1_08
- version/sun java runtime environment (jre)/1.3.1_09
- version/sun java runtime environment (jre)/1.3.1_10
- version/sun java runtime environment (jre)/1.3.1_11
- version/sun java runtime environment (jre)/1.3.1_12
- version/sun java runtime environment (jre)/1.3.1_13
- version/sun java runtime environment (jre)/1.3.1_14
- version/sun java runtime environment (jre)/1.3.1_15
- version/sun java runtime environment (jre)/1.3.1_16
- version/sun java runtime environment (jre)/1.3.1_17
- version/sun java runtime environment (jre)/1.3.1_18
- version/sun java runtime environment (jre)/1.3.1_19
- version/sun java runtime environment (jre)/1.3.1_20
- version/sun java runtime environment (jre)/1.3.1_21
- version/sun java runtime environment (jre)/1.3.1_22
- version/sun java runtime environment (jre)/1.3.1_23
- version/sun java runtime environment (jre)/1.4.2
- version/sun java runtime environment (jre)/1.4.2_1
- version/sun java runtime environment (jre)/1.4.2_2
- version/sun java runtime environment (jre)/1.4.2_3
- version/sun java runtime environment (jre)/1.4.2_4
- version/sun java runtime environment (jre)/1.4.2_5
- version/sun java runtime environment (jre)/1.4.2_6
- version/sun java runtime environment (jre)/1.4.2_7
- version/sun java runtime environment (jre)/1.4.2_8
- version/sun java runtime environment (jre)/1.4.2_9
- version/sun java runtime environment (jre)/1.4.2_10
- version/sun java runtime environment (jre)/1.4.2_11
- version/sun java runtime environment (jre)/1.4.2_12
- version/sun java runtime environment (jre)/1.4.2_13
- version/sun java runtime environment (jre)/1.4.2_14
- version/sun java runtime environment (jre)/1.4.2_15
- version/sun java runtime environment (jre)/1.4.2_16
- version/sun java runtime environment (jre)/1.4.2_17
- version/sun java runtime environment (jre)/1.4.2_18
- version/sun java runtime environment (jre)/1.5.0
- version/sun java runtime environment (jre)/1.5.0-update1
- version/sun java runtime environment (jre)/1.5.0-update10
- version/sun java runtime environment (jre)/1.5.0-update11
- version/sun java runtime environment (jre)/1.5.0-update12
- version/sun java runtime environment (jre)/1.5.0-update13
- version/sun java runtime environment (jre)/1.5.0-update14
- version/sun java runtime environment (jre)/1.5.0-update15
- version/sun java runtime environment (jre)/1.5.0-update16
- version/sun java runtime environment (jre)/1.5.0-update2
- version/sun java runtime environment (jre)/1.6.0
- version/sun java runtime environment (jre)/1.6.0-update_1
- version/sun java runtime environment (jre)/1.6.0-update_10
- version/sun java runtime environment (jre)/1.6.0-update_2
- version/sun java runtime environment (jre)/1.6.0-update_3
- version/sun java runtime environment (jre)/1.6.0-update_4
- version/sun java runtime environment (jre)/1.6.0-update_5
- version/sun java runtime environment (jre)/1.6.0-update_6
- canonical/java development kit (jdk)
- version/java development kit (jdk)/1.5.0
- version/java development kit (jdk)/1.5.0-update1
- version/java development kit (jdk)/1.5.0-update10
- version/java development kit (jdk)/1.5.0-update2
- version/java development kit (jdk)/1.5.0-update3
- version/java development kit (jdk)/1.5.0-update4
- version/java development kit (jdk)/1.5.0-update5
- version/java development kit (jdk)/1.5.0-update6
- version/java development kit (jdk)/1.5.0-update7
- version/java development kit (jdk)/1.5.0-update7_b03
- version/java development kit (jdk)/1.5.0-update8
- version/java development kit (jdk)/1.5.0-update9
- version/java development kit (jdk)/1.6.0
- version/java development kit (jdk)/1.6.0-update_10
- version/java development kit (jdk)/1.6.0-update_3
- version/java development kit (jdk)/1.6.0-update_4
- version/java development kit (jdk)/1.6.0-update_5
- version/java development kit (jdk)/1.6.0-update_6
- version/java development kit (jdk)/1.6.0-update_7
- version/java development kit (jdk)/1.3.1
- version/java development kit (jdk)/1.3.1_01
- version/java development kit (jdk)/1.3.1_01a
- version/java development kit (jdk)/1.3.1_02
- version/java development kit (jdk)/1.3.1_03
- version/java development kit (jdk)/1.3.1_04
- version/java development kit (jdk)/1.3.1_05
- version/java development kit (jdk)/1.3.1_06
- version/java development kit (jdk)/1.3.1_07
- version/java development kit (jdk)/1.3.1_08
- version/java development kit (jdk)/1.3.1_09
- version/java development kit (jdk)/1.3.1_10
- version/java development kit (jdk)/1.3.1_11
- version/java development kit (jdk)/1.3.1_12
- version/java development kit (jdk)/1.3.1_13
- version/java development kit (jdk)/1.3.1_14
- version/java development kit (jdk)/1.3.1_15
- version/java development kit (jdk)/1.3.1_16
- version/java development kit (jdk)/1.3.1_17
- version/java development kit (jdk)/1.3.1_18
- version/java development kit (jdk)/1.3.1_19
- version/java development kit (jdk)/1.3.1_20
- version/java development kit (jdk)/1.3.1_21
- version/java development kit (jdk)/1.3.1_22
- version/java development kit (jdk)/1.3.1_23
- version/java development kit (jdk)/1.4.2
- version/java development kit (jdk)/1.4.2_1
- version/java development kit (jdk)/1.4.2_2
- version/java development kit (jdk)/1.4.2_02
- version/java development kit (jdk)/1.4.2_03
- version/java development kit (jdk)/1.4.2_3
- version/java development kit (jdk)/1.4.2_04
- version/java development kit (jdk)/1.4.2_4
- version/java development kit (jdk)/1.4.2_5
- version/java development kit (jdk)/1.4.2_6
- version/java development kit (jdk)/1.4.2_7
- version/java development kit (jdk)/1.4.2_8
- version/java development kit (jdk)/1.4.2_08
- version/java development kit (jdk)/1.4.2_09
- version/java development kit (jdk)/1.4.2_9
- version/java development kit (jdk)/1.4.2_10
- version/java development kit (jdk)/1.4.2_11
- version/java development kit (jdk)/1.4.2_12
- version/java development kit (jdk)/1.4.2_13
- version/java development kit (jdk)/1.4.2_14
- version/java development kit (jdk)/1.4.2_15
- version/java development kit (jdk)/1.4.2_16
- version/java development kit (jdk)/1.4.2_17
- version/java development kit (jdk)/1.4.2_18