CVE-2008-1188
Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6...
9.3 High
Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allow remote attackers to execute arbitrary code via a JNLP file with (1) a long key name in the xml header or (2) a long charset value, different issues than CVE-2008-1189, aka "The first two issues."
Exploit likelihood
12.5%Up 2.6 points since Feb 4, 2022
What each source reports
NVD Score used
Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allow remote attackers to execute arbitrary code via a JNLP file with (1) a long key name in the xml header or (2) a long charset value, different issues than CVE-2008-1189, aka "The first two issues."
- Record
CVE-2008-1188- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allow remote attackers to execute arbitrary code via a JNLP file with (1) a long key name in the xml header or (2) a long charset value, different issues than CVE-2008-1189, aka "The first two issues."
- Record
CVE-2008-1188- Updated
- 2026-11-02
EUVDEUVD-2008-1197 No score
Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allow remote attackers to execute arbitrary code via a JNLP file with (1) a long key name in the xml header or (2) a long charset value, different issues than CVE-2008-1189, aka "The first two issues."
- Record
EUVD-2008-1197- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x67m-cmr9-2j82 No score
Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6...
Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allow remote attackers to execute arbitrary code via a JNLP file with (1) a long key name in the xml header or (2) a long charset value, different issues than CVE-2008-1189, aka "The first two issues."
- Record
GHSA-x67m-cmr9-2j82- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.5.0-sunRed Hat:rhel_extras:4 From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el4 | 0:1.5.0.15-1jpp.2.el4 |
java-1.5.0-sun-demoRed Hat:rhel_extras:4 From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el4 | 0:1.5.0.15-1jpp.2.el4 |
java-1.5.0-sun-develRed Hat:rhel_extras:4 From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el4 | 0:1.5.0.15-1jpp.2.el4 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:4 From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el4 | 0:1.5.0.15-1jpp.2.el4 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:4 From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el4 | 0:1.5.0.15-1jpp.2.el4 |
java-1.5.0-sun-srcRed Hat:rhel_extras:4 From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el4 | 0:1.5.0.15-1jpp.2.el4 |
java-1.5.0-sunRed Hat:rhel_extras:5::client From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::client From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::client From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::client From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
Show 49 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::client From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::client From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-sunRed Hat:rhel_extras:5::server From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::server From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::server From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::server From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::server From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::server From an advisory covering 11 CVEs |
before 0:1.5.0.15-1jpp.2.el5 | 0:1.5.0.15-1jpp.2.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:4 From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el4 | 1:1.5.0.7-1jpp.2.el4 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:4 From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el4 | 1:1.5.0.7-1jpp.2.el4 |
java-1.5.0-ibm-develRed Hat:rhel_extras:4 From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el4 | 1:1.5.0.7-1jpp.2.el4 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:4 From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el4 | 1:1.5.0.7-1jpp.2.el4 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:4 From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el4 | 1:1.5.0.7-1jpp.2.el4 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:4 From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el4 | 1:1.5.0.7-1jpp.2.el4 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:4 From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el4 | 1:1.5.0.7-1jpp.2.el4 |
java-1.5.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.5.0.7-1jpp.2.el5 | 1:1.5.0.7-1jpp.2.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.1-1jpp.2.el5 | 1:1.6.0.1-1jpp.2.el5 |
java-1.5.0-ibmRed Hat:network_satellite:5.1::el4 From an advisory covering 17 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
java-1.5.0-ibm-develRed Hat:network_satellite:5.1::el4 From an advisory covering 17 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1188 is a high vulnerability (CVSS 9.3) in Sun Jdk, published March 6, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.5%, the 96th percentile. No source names a fixed version.
References
lists.apple.com/archives/security-announce//2008/Sep/msg00008.html
secunia.com/advisories/30676
redhat.com/support/errata/RHSA-2008-0267.html
lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html
securitytracker.com/id?1019549
zerodayinitiative.com/advisories/ZDI-08-009
Show 122 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/41029
security.gentoo.org/glsa/glsa-200804-28.xml
us-cert.gov/cas/techalerts/TA08-066A.html
support.apple.com/kb/HT3178
vupen.com/english/advisories/2008/0770/references
sunsolve.sun.com/search/document.do?assetkey=1-26-233323-1
vmware.com/security/advisories/VMSA-2008-0010.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11209
gentoo.org/security/en/glsa/glsa-200804-20.xml
nvd.nist.gov/vuln/detail/CVE-2008-1188
github.com/advisories/GHSA-x67m-cmr9-2j82
access.redhat.com/errata/RHSA-2008:0186
bugzilla.redhat.com/show_bug.cgi?id=436029
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0186.json
cve.org/CVERecord?id=CVE-2008-1185
www-128.ibm.com/developerworks/java/jdk/alerts