CVE-2008-5352

CVE-2008-5352: Integer overflow in Pack200 jar unpacking in unpack200 (unpack.dll) used by Java Runtime Environment (JRE) for Sun JDK/JRE. Affected: JRE/JDK 6 Update 10 and earlier, and JDK/JRE 5.0 Update 16 and earlier. The overflow in the heap-based buffer can allow untrusted applications and a...

CVE-2008-5357

The CVE-2008-5357 issue is an integer/heap-based overflow in Java Runtime Environment font parsing. A crafted TrueType font file can trigger arbitrary code execution. Affected products include Sun JDK/JRE 6 Update 10 and earlier; JDK/JRE 5.0 Update 16 and earlier; SDK/JRE 1.4.2_18 and earlier; SD...

CVE-2010-3572

CVE-2010-3572 is described as an unspecified vulnerability in the Sound component of Oracle Java SE and Java for Business across several versions (6 Update 21; 5.0 Update 25; 1.4.2_27; 1.3.1_28) that could allow remote attackers to affect confidentiality, integrity, and availability via unknown v...

CVE-2011-0869

CVE-2011-0869 affects Oracle Java SE 6 Update 26 and earlier in the JRE. The vulnerability is in the JRE’s SAAJ handling and could allow remote untrusted Java Web Start applications or applets to disclose data (confidentiality impact). The MiracleLinux/Nessus OpenVAS entries confirm the CVE and r...

CVE-2008-0657

CVE-2008-0657 affects Sun JDK/JRE: Java 2 Platform versions in scope include JRE/JDK 6 Update 1 and earlier, and 5.0 Update 13 and earlier. The underlying issue is multiple, unspecified vulnerabilities in the Java Runtime Environment that allow an untrusted application or applet to elevate privil...

CVE-2010-0094

CVE-2010-0094 is documented in IBM’s Oracle Java SE vulnerability bulletin as affecting Oracle Java SE and Java for Business via missing privilege checks during deserialization of RMIConnectionImpl objects, enabling remote code execution. CVSS Base score is 7.5 (NETWORK, LOW attack complexity, no...

CVE-2010-3568

CVE-2010-3568 is described as an OpenJDK deserialization race condition affecting Java Runtime Environment components. The initial report cites impact to confidentiality, integrity, and availability via unspecified vectors in Oracle Java SE/Java for Business 6u21, 5.0u25, and 1.4.2_27. Connected ...

CVE-2011-3550

Technical details for CVE-2011-3550 are not provided in the connected documents. Monitor for updates.

CVE-2008-3111

CVE-2008-3111 affects Sun Java Web Start in JDK/JRE 6 prior to Update 4, JDK/JRE 5.0 prior to Update 16, and SDK/JRE 1.4.x prior to 1.4.2_18. The root cause is a stack-based buffer overflow in GetVMArgsOption triggered by a long value in a j2se tag in a JNLP file, allowing context-dependent attac...

CVE-2010-4472

MiracleLinux 4 hosts with java-1.6.0-openjdk packages are listed as affected by CVE-2010-4472 in AXSA:2011-61:02. The CVE entry describes an unspecified vulnerability in the Java Runtime Environment (JRE) related to XML Digital Signature and APIs, leading to availability impact. The MiracleLinux ...

CVE-2008-5341

CVE-2008-5341 describes an unspecified vulnerability in Sun Java Web Start (JWS) and Java Plug-in affecting Sun JDK/JRE 6 Update 10 and earlier, and JDK/JRE 5.0 Update 16 and earlier. The issue allows untrusted JWS applications to obtain the pathname of the JWS cache and the application username ...

CVE-2008-5348

CVE-2008-5348 concerns an unspecified vulnerability in Sun JDK/JRE across multiple major versions (JDK/JRE 6 Update 10 and earlier; 5.0 Update 16 and earlier; 1.4.2_18 and earlier) that, when Kerberos authentication is used, can allow remote attackers to cause a denial of service through OS resou...

CVE-2010-3557

The CVE-2010-3557 entry concerns a Swing component vulnerability in Oracle Java SE/Java for Business. Affected products/versions are Oracle Java SE 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28. Root cause and concrete vectors are not publicly detailed in the provided documents; however, the...

CVE-2010-4470

CVE-2010-4470 is described as an unspecified vulnerability in the Java Runtime Environment (JRE) for Oracle Java SE/Java for Business 6 Update 23 and earlier, allowing remote attackers to affect availability via unknown vectors related to JAXP and unspecified APIs. The connected MiracleLinux advi...

CVE-2009-1106

CVE-2009-1106 affects Java Plug-in in JDK/JRE 6 Update 12, 11, and 10. The crossdomain.xml parser can be bypassed, allowing a remote attacker to connect to arbitrary sites and bypass access restrictions. Documented impact includes partial integrity and partial availability, with no confidentialit...

CVE-2009-3882

CVE-2009-3882 affects Sun Java SE 5.0 (before Update 22) and Java SE 6 (before Update 17), as well as OpenJDK. Root cause is an information leak in mutable variables (Bug 6657026) in the Swing implementation. Consequences include potential information disclosure and related partial impacts to con...

CVE-2010-0847

CVE-2010-0847 is described in connected Nessus/OSINT sources as an OpenJDK ImagingLib arbitrary code execution vulnerability in the Java 6 OpenJDK/OpenJDK stack (OpenJDK ImagingLib component). Affected product lineage appears to be Java 1.6/OpenJDK builds that include ImagingLib; the exact affect...

CVE-2010-3541

CVE-2010-3541 affects Oracle Java SE/Java for Business (e.g., 6 Update 21; 5.0 Update 25; 1.4.2_27; 1.3.1_28) and is linked in OpenVAS/SUSE advisories. The Connected/OpenVAS entries note the vulnerability arises from limit setting of some request headers in HttpURLConnection, impacting confidenti...

CVE-2009-3865

CVE-2009-3865 affects Sun Java SE/JDK 6 with JRE before Update 17, specifically the Deployment Toolkit launch method in Sun Java Runtime Environment. The vulnerability allows remote code execution via a crafted web page, as indicated by Bug 6869752. The referenced sources describe the issue in th...

CVE-2010-3559

CVE-2010-3559 affects Oracle Java SE/Java for Business (6u21, 5.0u25, 1.4.2_27, 1.3.1_28). The SUSE entry describes an unspecified vulnerability in the Sound component tied to a likely incorrect sign extension in HeadspaceSoundbank.nGetName, enabling a buffer overflow via a crafted BANK record an...

CVE-2010-3573

Technical details for CVE-2010-3573 are not publicly available in the provided documents. No affected products, root cause, or remediation are specified here. Monitor for future updates in connected feeds.

CVE-2010-4466

CVE-2010-4466 concerns a vulnerability in the Deployment component of Oracle Java SE/JRE (and Java for Business) affecting multiple platforms. According to connected Red Hat advisory RHSA-2011:0870, it is categorized as a JDK Deployment-component vulnerability and is identified among several CVEs...

CVE-2008-3105

CVE-2008-3105 refers to an unspecified vulnerability in the Sun JRE/JDK 6 Update 6 and earlier affecting the JAX-WS client and service. The issue allows remote attackers to cause a denial of service or access URLs via the processing of XML data by a trusted application. The description indicates ...

CVE-2008-3106

CVE-2008-3106 : Sun JRE/JDK 6 Update 6 and earlier and JDK/JRE 5.0 Update 15 and earlier contain an unspecified vulnerability in processing XML data by an untrusted application or applet, which could allow a remote attacker to access URLs. The description indicates a vulnerability in XML data han...

CVE-2009-3872

CVE-2009-3872 affects Sun Java SE/J2SE/JDK/JRE JPEG JFIF Decoder. A vulnerability in the JPEG decoding path allows remote attackers to gain privileges via a crafted image file. Affected products/versions include Sun Java 5.0 before Update 22, Java 6 before Update 17, and older SDK/JRE 1.3.x befor...

CVE-2010-0089

CVE-2010-0089 affects Oracle Java SE/Java for Business components (Java Web Start, Java Plug-in) in Java 6 Update 18, 5.0 Update 23, and 1.4.2_25. Connected data corroborate that multiple sources reference this CVE within a broader set of Java/VM vulnerabilities and related advisories; however, t...

CVE-2010-3561

CVE-2010-3561 is a concrete OpenJDK/OpenJDK-derived issue described as a Privileged ServerSocket.accept vulnerability that allows remote hosts to connect without proper restrictions. The connected advisories/plugins (e.g., openSUSE Java updates, Gentoo GLSA, and Nessus plugins) include CVE-2010-3...

CVE-2010-4462

CVE-2010-4462 affects Oracle Java SE/Java for Business 6u23 and earlier, 5.0u27 and earlier, and 1.4.2_29 and earlier. The vulnerability is described as an unspecified issue in the JRE related to Sound and unspecified APIs that could impact confidentiality, integrity, and availability via remote ...

CVE-2008-5347

Technical details for CVE-2008-5347 are not provided in the supplied documents; no affected product/version specifics beyond the initial description. Monitor for updates.

CVE-2008-5359

CVE-2008-5359 is a buffer overflow in the Sun Java Runtime Environment (JRE) affecting JRE/JDK versions up to: 6 Update 10 and earlier; 5.0 Update 16 and earlier; 1.4.2_18 and earlier; and 1.3.1_23 and earlier. Root cause involves a ConvolveOp operation in the AWT library, enabling a remote attac...

CVE-2010-4422

CVE-2010-4422 is an unspecified vulnerability in the Deployment area of Oracle Java SE/Java for Business 6 Update 23 and earlier. Documents confirm impact on confidentiality, integrity, and availability via Deployment-related vectors, with concrete references showing this CVE included in Java upd...

CVE-2010-4454

Technical details for CVE-2010-4454 are not publicly available in the provided documents. The initial description is unspecific and lacks concrete product/version/impact details or fixes; monitor for updates from official advisories or security feeds.

CVE-2010-3548

Technical details for CVE-2010-3548 are not publicly available in the provided documents. Monitor for updates.

CVE-2010-4463

CVE-2010-4463 affects Oracle Java SE/Java for Business 6 Update 21–23. It describes a Deployment-related vulnerability in JRE that allows remote untrusted Java Web Start applications and untrusted applets to affect confidentiality, integrity, and availability via unspecified vectors. No exploit d...

CVE-2008-5340

CVE-2008-5340 concerns an unspecified vulnerability in Java Web Start (JWS) and Java Plug-in affecting Sun JDK/JRE lines: Java SE 6 Update 10 and earlier; Java SE 5.0 Update 16 and earlier; and SDK/JRE 1.4.2_18 and earlier. The untrusted JWS applications can gain privileges to access local files ...

CVE-2008-5342

CVE-2008-5342 affects Sun Java implementations: BasicService for Java Web Start and Java Plug-in on Sun JDK/JRE 6u10 and earlier; JDK/JRE 5.0u16 and earlier; and SDK/JRE 1.4.2_18 and earlier. The vulnerability is described as an unspecified flaw in these components that could allow an untrusted d...

CVE-2010-4468

CVE-2010-4468 affects Oracle Java SE and Java for Business (JRE) 6 Update 23 and earlier, and 5.0 Update 27 and earlier. The provided description states an unspecified vulnerability in the JRE that allows remote, untrusted Java Web Start applications and untrusted applets to compromise confidenti...

CVE-2008-5356

CVE-2008-5356 describes a heap-based buffer overflow in Java Runtime Environment font parsing that can be triggered by a crafted TrueType font, potentially allowing remote code execution. Affected products include Sun JDK/JRE 6u10 and earlier, JDK/JRE 5.0u16 and earlier, and SDK/JRE 1.4.2_18 and ...

CVE-2010-0837

CVE-2010-0837 describes an unspecified vulnerability in the Pack200 component of Oracle Java SE and Java for Business . Affects versions listed in the initial entry (e.g., 6 Update 18, 5.0 Update, 23, etc.). The description notes a remote attacker could affect confidentiality, integrity, and avai...

CVE-2008-3108

CVE-2008-3108 describes a buffer overflow in the font processing component of Sun JRE/JDK across multiple older Java releases (JRE 5.0 before Update 10; JRE 1.4.x before 1.4.2_18; JRE 1.3.x before 1.3.1_23). The issue could allow context-dependent attackers to gain privileges on the affected host...

CVE-2008-5346

CVE-2008-5346 affects Sun JDK/JRE: untrusted applets and applications could read arbitrary memory via a crafted ZIP file. Affected are JRE/JDK 5.0 Update 16 and earlier; JRE 1.4.2_18 and earlier; JRE 1.3.1_23 or earlier. The connected docs confirm related advisories (e.g., RHSA entries) but do no...

CVE-2010-3551

Technical details for CVE-2010-3551 are not publicly available in the provided documents; monitoring for updates is advised.

CVE-2010-3554

CVE-2010-3554 is referenced in multiple advisories as a vulnerability in the OpenJDK CORBA reflection component that was fixed by updating Java packages (e.g., IcedTea/OpenJDK builds). Connected documents confirm its inclusion in OpenJDK/OpenJDK-related patch lists and advisories; no explicit roo...

CVE-2010-3565

CVE-2010-3565 is associated with OpenJDK/J2SE JPEG image handling (JPEGImageWriter.writeImage) and is described as enabling remote code execution via memory handling with large values in a JPEG subsample. Connected advisories explicitly reference OpenJDK/JDK contexts and list the issue among mult...

CVE-2007-5273

CVE-2007-5273 affects Sun JRE/JDK across multiple versions (JDK/JRE 6 Update 2 and earlier; 5.0 Update 12 and earlier; 1.4.2_15 and earlier; 1.3.1_20 and earlier). Root cause described as a multi-pin DNS rebinding issue when using an HTTP proxy: the applet download relies on DNS on the proxy whil...

CVE-2008-5343

Vulnerability GIFAR (CVE-2008-5343) affects Java Web Start (JWS) and Java Plug-in in Sun JDK/JRE 6u10 and earlier, JDK/JRE 5.0u16 and earlier, and SDK/JRE 1.4.2_18 and earlier. A crafted file that validates as both GIF and Java JAR can allow remote attackers to make unauthorized network connectio...

CVE-2010-0082

CVE-2010-0082 affects Oracle Java SE/Java for Business (HotSpot Server) with OpenJDK/OpenJRE components. The root cause is a loader-constraint table issue that may allow arrays beyond base classes. Affected products include Java 6 Update 18, Java 5.0 Update 23, Java 1.4.2_25, and Java 1.3.1_27. E...

CVE-2008-0628

CVE-2008-0628 affects Sun Java Runtime Environment (JRE/JDK) 6 Update 3 and earlier. The XML parsing code processes external entity references even when the “external general entities” property is false, enabling an XXE attack that can cause denial of service or allow access to restricted resourc...

CVE-2008-3114

CVE-2008-3114 affects Sun Java Web Start in JDK/JRE 6 prior to Update 7, JDK/JRE 5.0 prior to Update 16, and SDK/JRE 1.4.x prior to 1.4.2_18. The issue allows context-dependent attackers to obtain the cache location via an untrusted application (information disclosure). Remediation is to apply th...

CVE-2010-0088

CVE-2010-0088 is an Oracle Java SE/Java for Business JRE vulnerability affecting multiple older Java runtimes (e.g., Java 6 Update 18, 5.0 Update 23, 1.4.2_25, 1.3.1_27) via an unspecified vulnerability in the Java Runtime Environment. Connected sources specify the concrete issue as OpenJDK/OpenJ...