CVE-2008-3111 Memory corruption in n/a

Critical 10.0 Published 9 Jul 2008 Updated 7 Aug 2024

Buffer overflows in Sun Java Web Start allow attackers to execute arbitrary code and escalate privileges via malicious JNLP files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2008-3111?

CVE-2008-3111 is a critical memory corruption vulnerability in Sun Jdk, published on 9 Jul 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.

Weakness: CWE-20, CWE-119

Which versions are affected by CVE-2008-3111?

It affects 3 products.

Products include Sun Jdk, Sun Jre, Sun Sdk.

How do I fix CVE-2008-3111?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2008-3111 being exploited?

There is no known exploitation of CVE-2008-3111 in the wild and no public exploit code.

All Sun Jdk vulnerabilities

Sources

Also known as GHSA-984m-qj9q-3464.