CVE-2008-3108
Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 4.61% probability · 92th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- sun/jre · sun/jdk · sun/sdk
- Source
- cve@mitre.org
EPSS 4.6% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00002.htmlMailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=122331139823057&w=2Mailing List, Third Party Advisory
- http://secunia.com/advisories/31010Third Party Advisory
- http://secunia.com/advisories/31320Third Party Advisory
- http://secunia.com/advisories/31497Third Party Advisory
- http://secunia.com/advisories/31600Third Party Advisory
- http://secunia.com/advisories/31736Third Party Advisory
- http://secunia.com/advisories/32018Third Party Advisory
- http://secunia.com/advisories/32179Third Party Advisory
- http://secunia.com/advisories/32180Third Party Advisory
- http://secunia.com/advisories/33236Third Party Advisory
- http://secunia.com/advisories/33237Third Party Advisory
- http://secunia.com/advisories/37386Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200911-02.xmlThird Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-238666-1Broken Link
- http://support.apple.com/kb/HT3178Third Party Advisory
- http://support.apple.com/kb/HT3179Third Party Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-300.htmThird Party Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-507.htmThird Party Advisory
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=751014Third Party Advisory
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=756717Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0790.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-1043.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-1044.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/497041/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/30147Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1020461Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.