CVE-2008-3112
high · 10Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.
10
CVSS
25.7%
EPSS (exploit prob.)
98th
EPSS percentile
2008-07-09
Published
AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-264
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sun | jdk | <= 5.0 |
| sun | jdk | <= 6 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 5.0 |
| sun | jdk | 6 |
| sun | jdk | 6 |
| sun | jdk | 6 |
| sun | jdk | 6 |
| sun | jdk | 6 |
| sun | jre | <= 1.4.2_17 |
| sun | jre | <= 5.0 |
| sun | jre | <= 6 |
| sun | jre | 1.4.2 |
| sun | jre | 1.4.2_01 |
| sun | jre | 1.4.2_02 |
| sun | jre | 1.4.2_03 |
| sun | jre | 1.4.2_04 |
| sun | jre | 1.4.2_05 |
| sun | jre | 1.4.2_06 |
| sun | jre | 1.4.2_07 |
| sun | jre | 1.4.2_8 |
| sun | jre | 1.4.2_9 |
| sun | jre | 1.4.2_10 |
| sun | jre | 1.4.2_11 |
| sun | jre | 1.4.2_12 |
| sun | jre | 1.4.2_13 |
| sun | jre | 1.4.2_14 |
| sun | jre | 1.4.2_15 |
| sun | jre | 1.4.2_16 |
Check a specific version with /api/v1/cve/match.
References
- http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
- http://marc.info/?l=bugtraq&m=122331139823057&w=2
- http://rhn.redhat.com/errata/RHSA-2008-0955.html
- http://secunia.com/advisories/31010
- http://secunia.com/advisories/31055
- http://secunia.com/advisories/31320
- http://secunia.com/advisories/31497
- http://secunia.com/advisories/31600
- http://secunia.com/advisories/31736
- http://secunia.com/advisories/32018
- http://secunia.com/advisories/32179
- http://secunia.com/advisories/32180
- http://secunia.com/advisories/32436
- http://secunia.com/advisories/32826
- http://secunia.com/advisories/33194
- http://secunia.com/advisories/35065
- http://secunia.com/advisories/37386
- http://security.gentoo.org/glsa/glsa-200911-02.xml
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-238905-1
- http://support.apple.com/kb/HT3178
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2008-3112