HIGH
Security Vulnerability with JRE fonts processing may allow Elevation of Privileges (6450319)
Published Jul 9, 2008
10.0
HIGHCVSS 2.0
EPSS 4.61%
Description
Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing.
Affected products
No data.
Configuration 1
OR
- 1.3.1
- 1.3.1_2
- 1.3.1_03
- 1.3.1_04
- 1.3.1_05
- 1.3.1_06
- 1.3.1_07
- 1.3.1_08
- 1.3.1_09
- 1.3.1_10
- 1.3.1_11
- 1.3.1_12
- 1.3.1_13
- 1.3.1_14
- 1.3.1_15
- 1.3.1_16
- 1.3.1_17
- 1.3.1_18
- 1.3.1_19
- 1.3.1_20
- 1.3.1_21
- 1.3.1_22
- 1.3.1_23
- 1.4.2
- 1.4.2_1
- 1.4.2_2
- 1.4.2_3
- 1.4.2_4
- 1.4.2_5
- 1.4.2_6
- 1.4.2_7
- 1.4.2_8
- 1.4.2_9
- 1.4.2_10
- 1.4.2_11
- 1.4.2_12
- 1.4.2_13
- 1.4.2_14
- 1.4.2_15
- 1.4.2_16
- 1.4.2_17
- 1.4.2_18
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
Configuration 2
OR
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
Configuration 3
OR
- 1.3.1
- 1.3.1_01
- 1.3.1_01a
- 1.3.1_02
- 1.3.1_03
- 1.3.1_04
- 1.3.1_05
- 1.3.1_06
- 1.3.1_07
- 1.3.1_08
- 1.3.1_09
- 1.3.1_10
- 1.3.1_11
- 1.3.1_12
- 1.3.1_13
- 1.3.1_14
- 1.3.1_15
- 1.3.1_16
- 1.3.1_17
- 1.3.1_18
- 1.3.1_19
- 1.3.1_20
- 1.3.1_21
- 1.3.1_22
- 1.3.1_23
- 1.4.2
- 1.4.2_1
- 1.4.2_2
- 1.4.2_02
- 1.4.2_03
- 1.4.2_3
- 1.4.2_04
- 1.4.2_4
- 1.4.2_5
- 1.4.2_6
- 1.4.2_7
- 1.4.2_8
- 1.4.2_08
- 1.4.2_09
- 1.4.2_9
- 1.4.2_10
- 1.4.2_11
- 1.4.2_12
- 1.4.2_13
- 1.4.2_14
- 1.4.2_15
- 1.4.2_16
- 1.4.2_17
- 1.4.2_18
No data.
Extras for RHEL 4
java-1.5.0-ibm-1:1.5.0.8-1jpp.1.el4
Fixed · RHSA-2008:0790
Red Hat Network Satellite Server v 5.1
java-1.5.0-ibm-1:1.5.0.8-1jpp.1.el4
Fixed · RHSA-2008:0638
Supplementary for Red Hat Enterprise Linux 5
java-1.5.0-ibm-1:1.5.0.8-1jpp.1.el5
Fixed · RHSA-2008:0790
| Product | Package | State | Advisory |
|---|---|---|---|
| Extras for RHEL 4 | java-1.5.0-ibm-1:1.5.0.8-1jpp.1.el4 | Fixed | RHSA-2008:0790 |
| Red Hat Network Satellite Server v 5.1 | java-1.5.0-ibm-1:1.5.0.8-1jpp.1.el4 | Fixed | RHSA-2008:0638 |
| Supplementary for Red Hat Enterprise Linux 5 | java-1.5.0-ibm-1:1.5.0.8-1jpp.1.el5 | Fixed | RHSA-2008:0790 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
10.0 HIGH NVD
AV:N/AC:L/Au:N/C:C/I:C/A:C
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
4.61% 0.04614
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
EPSS probability 0.04614
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (14 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 4.61% (0.04614) | 91.41th | v5 (v2026.06.15) |
| Jun 15, 2026 | 4.61% (0.04614) | 90.46th | v5 (v2026.06.15) |
| Oct 16, 2025 | 8.62% (0.08616) | 92.00th | v4 (v2025.03.14) |
| Mar 29, 2025 | 10.59% (0.10594) | 88.72th | v4 (v2025.03.14) |
| Mar 17, 2025 | 11.62% (0.11620) | 93.10th | v4 (v2025.03.14) |
| Dec 17, 2024 | 17.13% (0.17131) | 96.05th | v3 (v2023.03.01) |
| Dec 12, 2024 | 0.97% (0.00970) | 84.03th | v3 (v2023.03.01) |
| Jun 9, 2024 | 1.51% (0.01514) | 87.01th | v3 (v2023.03.01) |
| May 5, 2024 | 2.06% (0.02061) | 88.95th | v3 (v2023.03.01) |
| Mar 30, 2024 | 1.46% (0.01463) | 86.45th | v3 (v2023.03.01) |
| Mar 7, 2023 | 1.10% (0.01103) | 82.20th | v3 (v2023.03.01) |
| Mar 6, 2023 | 2.69% (0.02686) | 82.85th | v2 (v2022.01.01) |
| Apr 1, 2022 | 2.69% (0.02686) | 81.17th | v2 (v2022.01.01) |
| Feb 4, 2022 | 2.69% (0.02686) | 62.66th | v2 (v2022.01.01) |
Weaknesses (1)
References (39)
- http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html vendor-advisoryx_refsource_APPLEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00002.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://marc.info/?l=bugtraq&m=122331139823057&w=2 mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory
- http://secunia.com/advisories/31010 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/31320 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/31497 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/31600 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/31736 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/32018 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/32179 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/32180 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/33236 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/33237 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/37386 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://security.gentoo.org/glsa/glsa-200911-02.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-238666-1 vendor-advisoryx_refsource_SUNALERTBroken Link
- http://support.apple.com/kb/HT3178 x_refsource_CONFIRMThird Party Advisory
- http://support.apple.com/kb/HT3179 x_refsource_CONFIRMThird Party Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-300.htm x_refsource_CONFIRMThird Party Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-507.htm x_refsource_CONFIRMThird Party Advisory
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=751014 x_refsource_CONFIRMThird Party Advisory
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=756717 x_refsource_CONFIRMThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0790.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-1043.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-1044.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://www.securityfocus.com/archive/1/497041/100/0/threaded mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/30147 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1020461 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- http://www.us-cert.gov/cas/techalerts/TA08-193A.html third-party-advisoryx_refsource_CERTThird Party AdvisoryUS Government Resource
- http://www.vmware.com/security/advisories/VMSA-2008-0016.html x_refsource_CONFIRMThird Party Advisory
- http://www.vupen.com/english/advisories/2008/2056/references vdb-entryx_refsource_VUPENThird Party Advisory
- http://www.vupen.com/english/advisories/2008/2740 vdb-entryx_refsource_VUPENThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2008-3108 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=454604 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43656 vdb-entryx_refsource_XFVDB Entry
- https://nvd.nist.gov/vuln/detail/CVE-2008-3108
- https://www.cve.org/CVERecord?id=CVE-2008-3108
| Link | Providers | Tags |
|---|---|---|
| http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html | vendor-advisoryx_refsource_APPLEMailing ListThird Party Advisory | |
| http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html | vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory | |
| http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html | vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory | |
| http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00002.html | vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory | |
| http://marc.info/?l=bugtraq&m=122331139823057&w=2 | mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory | |
| http://secunia.com/advisories/31010 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://secunia.com/advisories/31320 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://secunia.com/advisories/31497 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://secunia.com/advisories/31600 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://secunia.com/advisories/31736 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://secunia.com/advisories/32018 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://secunia.com/advisories/32179 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://secunia.com/advisories/32180 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://secunia.com/advisories/33236 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://secunia.com/advisories/33237 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://secunia.com/advisories/37386 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://security.gentoo.org/glsa/glsa-200911-02.xml | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| http://sunsolve.sun.com/search/document.do?assetkey=1-66-238666-1 | vendor-advisoryx_refsource_SUNALERTBroken Link | |
| http://support.apple.com/kb/HT3178 | x_refsource_CONFIRMThird Party Advisory | |
| http://support.apple.com/kb/HT3179 | x_refsource_CONFIRMThird Party Advisory | |
| http://support.avaya.com/elmodocs2/security/ASA-2008-300.htm | x_refsource_CONFIRMThird Party Advisory | |
| http://support.avaya.com/elmodocs2/security/ASA-2008-507.htm | x_refsource_CONFIRMThird Party Advisory | |
| http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=751014 | x_refsource_CONFIRMThird Party Advisory | |
| http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=756717 | x_refsource_CONFIRMThird Party Advisory | |
| http://www.redhat.com/support/errata/RHSA-2008-0790.html | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| http://www.redhat.com/support/errata/RHSA-2008-1043.html | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| http://www.redhat.com/support/errata/RHSA-2008-1044.html | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| http://www.securityfocus.com/archive/1/497041/100/0/threaded | mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry | |
| http://www.securityfocus.com/bid/30147 | vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry | |
| http://www.securitytracker.com/id?1020461 | vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry | |
| http://www.us-cert.gov/cas/techalerts/TA08-193A.html | third-party-advisoryx_refsource_CERTThird Party AdvisoryUS Government Resource | |
| http://www.vmware.com/security/advisories/VMSA-2008-0016.html | x_refsource_CONFIRMThird Party Advisory | |
| http://www.vupen.com/english/advisories/2008/2056/references | vdb-entryx_refsource_VUPENThird Party Advisory | |
| http://www.vupen.com/english/advisories/2008/2740 | vdb-entryx_refsource_VUPENThird Party Advisory | |
| https://access.redhat.com/security/cve/CVE-2008-3108 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=454604 | Issue Tracking | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/43656 | vdb-entryx_refsource_XFVDB Entry | |
| https://nvd.nist.gov/vuln/detail/CVE-2008-3108 | ||
| https://www.cve.org/CVERecord?id=CVE-2008-3108 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jul 9, 2008
Updated Aug 7, 2024
Reserved Jul 9, 2008
Link CVE-2008-3108
CISA Vulnrichment
Updated n/a