Description
Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to gain privileges via an untrusted application.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.5.0-bea +5 | 1.5.0.14-1jpp.2.el5 | RHSA-2008:0244 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.7-1jpp.2.el5 | RHSA-2008:0210 |
| RHEL 5 | java-1.5.0-sun +5 | 1.5.0.15-1jpp.2.el5 | RHSA-2008:0186 |
| RHEL 5 | java-1.6.0-bea +5 | 1:1.6.0.03-1jpp.2.el5 | RHSA-2008:0245 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.1-1jpp.2.el5 | RHSA-2008:0267 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.7-1jpp.2.el4 | RHSA-2008:0210 |
| RHEL 4 | java-1.5.0-sun +5 | 1.5.0.15-1jpp.2.el4 | RHSA-2008:0186 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.5.0-ibm +1 | 1:1.5.0.8-1jpp.1.el4 | RHSA-2008:0638 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Sun Java Runtime Environment 1.x - Image Parsing Heap Buffer Overflow EDB-31343 · dos · Mar 6, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2008:0638 Red Hat Security Advisory: Red Hat Network Satellite Server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0267 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0245 Red Hat Security Advisory: java-1.6.0-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0244 Red Hat Security Advisory: java-1.5.0-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0210 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0186 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- APPLE-SA-2008-09-24 vendor-advisory
- 30676 third-party-advisory
- 29841 third-party-advisory
- sun-jre-imagelibrary-privilege-escalation(41028) vdb-entry
- RHSA-2008:0267 vendor-advisory
- SUSE-SA:2008:018 vendor-advisory
- 1019551 vdb-entry
- 233325 vendor-advisory
- RHSA-2008:0245 vendor-advisory
- 32018 third-party-advisory
- 29897 third-party-advisory
- 29498 third-party-advisory
- BEA08-201.00 vendor-advisory
- GLSA-200804-28 vendor-advisory
- 29239 third-party-advisory
- 29858 third-party-advisory
- TA08-066A third-party-advisory
- SUSE-SA:2008:025 vendor-advisory
- http://support.apple.com/kb/HT3178
- 29582 third-party-advisory
- ADV-2008-1252 vdb-entry
- ADV-2008-0770 vdb-entry
- 31497 third-party-advisory
- RHSA-2008:0210 vendor-advisory
- 28125 vdb-entry
- 30780 third-party-advisory
- RHSA-2008:0244 vendor-advisory
- ADV-2008-1856 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html
- 30003 third-party-advisory
- oval:org.mitre.oval:def:11409 vdb-entry signature
- GLSA-200804-20 vendor-advisory
- GLSA-200806-11 vendor-advisory
- RHSA-2008:0186 vendor-advisory
- http://support.apple.com/kb/HT3179
- 29273 third-party-advisory