CVE-2008-3111
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0...
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
Exploit likelihood
What each source reports
NVD Score used
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
- Record
CVE-2008-3111- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20, CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
- Record
CVE-2008-3111- Updated
- 2026-11-02
EUVDEUVD-2008-3101 No score
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
- Record
EUVD-2008-3101- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-984m-qj9q-3464 No score
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0...
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
- Record
GHSA-984m-qj9q-3464- Weakness
- CWE-20, CWE-119
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.5.0-sunRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el4 | 0:1.5.0.16-1jpp.2.el4 |
java-1.5.0-sun-demoRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el4 | 0:1.5.0.16-1jpp.2.el4 |
java-1.5.0-sun-develRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el4 | 0:1.5.0.16-1jpp.2.el4 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el4 | 0:1.5.0.16-1jpp.2.el4 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el4 | 0:1.5.0.16-1jpp.2.el4 |
java-1.5.0-sun-srcRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el4 | 0:1.5.0.16-1jpp.2.el4 |
java-1.5.0-sunRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
Show 35 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sunRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el5 | 0:1.5.0.16-1jpp.2.el5 |
java-1.5.0-sunRed Hat:network_satellite:5.1::el4 From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el4 | 0:1.5.0.16-1jpp.2.el4 |
java-1.5.0-sun-develRed Hat:network_satellite:5.1::el4 From an advisory covering 7 CVEs |
before 0:1.5.0.16-1jpp.2.el4 | 0:1.5.0.16-1jpp.2.el4 |
java-1.5.0-ibmRed Hat:network_satellite:5.1::el4 From an advisory covering 17 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
java-1.5.0-ibm-develRed Hat:network_satellite:5.1::el4 From an advisory covering 17 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
java-1.5.0-ibmRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
java-1.5.0-ibm-develRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:4 From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el4 | 1:1.5.0.8-1jpp.1.el4 |
java-1.5.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 7 CVEs |
before 1:1.5.0.8-1jpp.1.el5 | 1:1.5.0.8-1jpp.1.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3111 is a high vulnerability (CVSS 10.0) in Sun Jdk, published July 9, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.27%, the 91st percentile. No source names a fixed version.
References
lists.apple.com/archives/security-announce//2008/Sep/msg00008.html
marc.info?l=bugtraq&m=122331139823057&w=2
secunia.com/advisories/31600
lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html
security.gentoo.org/glsa/glsa-200911-02.xml
Show 110 moreShow less
vupen.com/english/advisories/2008/2740
exchange.xforce.ibmcloud.com/vulnerabilities/43664
sunsolve.sun.com/search/document.do?assetkey=1-66-238905-1
vmware.com/security/advisories/VMSA-2008-0016.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10541
support.apple.com/kb/HT3178
securitytracker.com/id?1020452
securityfocus.com/bid/30148
zerodayinitiative.com/advisories/ZDI-08-043
redhat.com/support/errata/RHSA-2008-0790.html
us-cert.gov/cas/techalerts/TA08-193A.html
nvd.nist.gov/vuln/detail/CVE-2008-3111
github.com/advisories/GHSA-984m-qj9q-3464
access.redhat.com/errata/RHSA-2008:0595
bugzilla.redhat.com/show_bug.cgi?id=452658
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0595.json
cve.org/CVERecord?id=CVE-2008-3103