CVE-2008-3109
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in...
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
- Record
CVE-2008-3109- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
- Record
CVE-2008-3109- Updated
- 2026-11-02
EUVDEUVD-2008-3099 No score
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
- Record
EUVD-2008-3099- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g75f-42vw-m3xv No score
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in...
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
- Record
GHSA-g75f-42vw-m3xv- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-sunRed Hat:rhel_extras:4 From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.2.el4 | 1:1.6.0.7-1jpp.2.el4 |
java-1.6.0-sun-demoRed Hat:rhel_extras:4 From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.2.el4 | 1:1.6.0.7-1jpp.2.el4 |
java-1.6.0-sun-develRed Hat:rhel_extras:4 From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.2.el4 | 1:1.6.0.7-1jpp.2.el4 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:4 From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.2.el4 | 1:1.6.0.7-1jpp.2.el4 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:4 From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.2.el4 | 1:1.6.0.7-1jpp.2.el4 |
java-1.6.0-sun-srcRed Hat:rhel_extras:4 From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.2.el4 | 1:1.6.0.7-1jpp.2.el4 |
java-1.6.0-sunRed Hat:rhel_extras:5::client From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::client From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::client From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::client From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
Show 31 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::client From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::client From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:5::server From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::server From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::server From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::server From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::server From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::server From an advisory covering 9 CVEs |
before 1:1.6.0.7-1jpp.1.el5 | 1:1.6.0.7-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el4 | 1:1.6.0.2-1jpp.2.el4 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el4 | 1:1.6.0.2-1jpp.2.el4 |
java-1.6.0-ibm-develRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el4 | 1:1.6.0.2-1jpp.2.el4 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el4 | 1:1.6.0.2-1jpp.2.el4 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el4 | 1:1.6.0.2-1jpp.2.el4 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el4 | 1:1.6.0.2-1jpp.2.el4 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el4 | 1:1.6.0.2-1jpp.2.el4 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 1:1.6.0.2-1jpp.2.el5 | 1:1.6.0.2-1jpp.2.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3109 is a high vulnerability (CVSS 7.5) in Sun Jdk, published July 9, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.56%, the 89th percentile. No source names a fixed version.
References
marc.info?l=bugtraq&m=122331139823057&w=2
secunia.com/advisories/32436
support.avaya.com/elmodocs2/security/ASA-2008-428.htm
lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html
Show 65 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/43660
sunsolve.sun.com/search/document.do?assetkey=1-66-238687-1
security.gentoo.org/glsa/glsa-200911-02.xml
vupen.com/english/advisories/2008/2740
securityfocus.com/bid/30144
lists.apple.com/archives/security-announce//2008/Sep/msg00007.html
vmware.com/security/advisories/VMSA-2008-0016.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8540
redhat.com/support/errata/RHSA-2008-0594.html
securitytracker.com/id?1020456
us-cert.gov/cas/techalerts/TA08-193A.html
support.apple.com/kb/HT3179
nvd.nist.gov/vuln/detail/CVE-2008-3109
github.com/advisories/GHSA-g75f-42vw-m3xv
access.redhat.com/errata/RHSA-2008:0594
bugzilla.redhat.com/show_bug.cgi?id=452649
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0594.json
cve.org/CVERecord?id=CVE-2008-3103
www-128.ibm.com/developerworks/java/jdk/alerts