(Oracle Issues Fix for BEA JRockit) Java Runtime Environment (JRE) Buffer Overflow in Processing Fonts Lets Remote Users Access Files and Gain Privileges on the Target System
|
|
SecurityTracker Alert ID: 1020745 |
|
SecurityTracker URL: http://securitytracker.com/id/1020745
|
|
CVE Reference:
CVE-2008-3108
(Links to External Site)
|
Date: Aug 25 2008
|
Impact:
Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): R27.6.0 and earlier (SDK and JRE 1.4.2), R27.1.0 and earlier (JDK and JRE 5.0)
|
Description:
A vulnerability was reported in Java Runtime Environment (JRE) in the processing of fonts. A remote user can access files on the target user's system. A remote user can cause arbitrary applications on the target user's system to be executed. BEA JRockit is affected.
A remote user can create a specially crafted applet or application that, when loaded by the target user, will trigger a buffer overflow in the processing of fonts to gain access to files on the target system or execute arbitrary applications residing on the target system.
John Heasman of NGSSoftware reported this vulnerability.
|
Impact:
A remote user can create an applet or application that, when loaded by the target user, will access files or execute arbitrary applications on the target user's system.
|
Solution:
Oracle has issued a fix for BEA JRockit, which is affected by this Java vulnerability.
The Oracle advisory is available at:
http://support.bea.com/application_content/product_portlets/securityadvisories/2798.html
|
Cause:
Boundary error
|
Underlying OS:
Linux (Any), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Mon, 25 Aug 2008 18:37:56 -0400
Subject: [none]
|
http://support.bea.com/application_content/product_portlets/securityadvisories/2798.html
CVE-2008-3108
|
|
