deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5316
Published: 2008-12-03
Description: Buffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in Little cms color engine (aka lcms) before 1.16 allows attackers to have an unknown impact via vectors related to a length parameter inconsistency involving the contents of "the input file," a different vulnerability than CVE-2007-2741.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lcms.cvs.sourceforge.net/viewvc/lcms/lcms/src/cmsio1.c?r1=1.33&r2=1.34; http://secunia.com/advisories/33066; http://www.debian.org/security/2008/dsa-1684
CVE: CVE-2008-5317
Published: 2008-12-03
Description: Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an allocation of insufficient memory.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lcms.cvs.sourceforge.net/viewvc/lcms/lcms/src/cmsgamma.c?view=diff&r1=1.16&r2=1.17; http://secunia.com/advisories/33066; http://secunia.com/advisories/33219
CVE: CVE-2008-5080
Published: 2008-12-03
Description: awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter.  NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495432#21; http://secunia.com/advisories/33002; http://www.ubuntu.com/usn/usn-686-1
CVE: CVE-2008-5318
Published: 2008-12-03
Description: Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-2008-3653.
CVSS Score: 5.0 (MEDIUM)
References: http://info.tikiwiki.org/tiki-read_article.php?articleId=41; http://secunia.com/advisories/32341; http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/2.0/changelog.txt?view=markup
CVE: CVE-2008-5319
Published: 2008-12-03
Description: Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to tiki-error.php, a different issue than CVE-2008-3653.
CVSS Score: 5.0 (MEDIUM)
References: http://info.tikiwiki.org/tiki-read_article.php?articleId=41; http://secunia.com/advisories/32341; http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/2.0/changelog.txt?view=markup
CVE: CVE-2008-5320
Published: 2008-12-03
Description: SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the ue[] parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32322; http://securityreason.com/securityalert/4683; http://www.securityfocus.com/bid/31821
CVE: CVE-2008-5321
Published: 2008-12-03
Description: SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the no parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4682; http://www.securityfocus.com/bid/31808; https://exchange.xforce.ibmcloud.com/vulnerabilities/45976
CVE: CVE-2008-5322
Published: 2008-12-03
Description: Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, which calls the phpinfo function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.org/0810-exploits/wysiwikiwyg-lfixssdisclose.txt; http://secunia.com/advisories/31061; https://exchange.xforce.ibmcloud.com/vulnerabilities/47105
CVE: CVE-2008-5323
Published: 2008-12-03
Description: Cross-site scripting (XSS) vulnerability in index.php in Wysi Wiki Wyg 1.0 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0810-exploits/wysiwikiwyg-lfixssdisclose.txt; http://secunia.com/advisories/31061; http://www.securityfocus.com/bid/31836
CVE: CVE-2008-2379
Published: 2008-12-05
Description: Cross-site scripting (XSS) vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink in an HTML part of an e-mail message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html; http://secunia.com/advisories/32143
CVE: CVE-2008-4416
Published: 2008-12-05
Description: Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7633&w=2; http://osvdb.org/50409; http://secunia.com/advisories/32969
CVE: CVE-2008-5324
Published: 2008-12-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in CQ Web in IBM Rational ClearQuest 2007 before 2007D and 2008 before 2008B allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PK69316; http://www-01.ibm.com/support/docview.wss?uid=swg1PK69316
CVE: CVE-2008-5325
Published: 2008-12-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in CQ Web in IBM Rational ClearQuest 7.0.0 before 7.0.0.4 and 7.0.1 before 7.0.1.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32847; http://www-01.ibm.com/support/docview.wss?uid=swg1PK69316; http://www.osvdb.org/50369
CVE: CVE-2008-5326
Published: 2008-12-05
Description: The ClearQuest Maintenance Tool in IBM Rational ClearQuest 7.0.0 before 7.0.0.4 and 7.0.1 before 7.0.1.3 on Windows allows local users to obtain (1) user and (2) database passwords by using a password revealer utility on a field containing a series of asterisks.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/32847; http://www-01.ibm.com/support/docview.wss?uid=swg1PK30938; http://www.securityfocus.com/bid/32577
CVE: CVE-2008-5327
Published: 2008-12-05
Description: The ClearQuest Maintenance Tool in IBM Rational ClearQuest 7 before 7.1 stores the database password in cleartext in an object in a ClearQuest connection profile or export file, which allows remote authenticated users to obtain sensitive information by locating the password object within the object tree.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/32847; http://www-01.ibm.com/support/docview.wss?uid=swg1PK65908; https://exchange.xforce.ibmcloud.com/vulnerabilities/46995
CVE: CVE-2008-5328
Published: 2008-12-05
Description: The ClearQuest Maintenance Tool in IBM Rational ClearQuest before 7 stores the database password in cleartext in an object in a ClearQuest connection profile or export file, which allows remote authenticated users to obtain sensitive information by locating the password object within the object tree during an import process.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/32847; http://www-01.ibm.com/support/docview.wss?uid=swg1PK65908; https://exchange.xforce.ibmcloud.com/vulnerabilities/46995
CVE: CVE-2008-5329
Published: 2008-12-05
Description: ClearQuest Web in IBM Rational ClearQuest MultiSite before 7.1 allows remote servers to direct a client's submissions and changes to an arbitrary database by specifying multiple comma-separated server identifiers on the JTLRMIREGISTRYSERVERS line in a jtl.properties file.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/32847; http://www-01.ibm.com/support/docview.wss?uid=swg1PK38745; https://exchange.xforce.ibmcloud.com/vulnerabilities/46993
CVE: CVE-2008-5330
Published: 2008-12-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface in ClearCase RWP server in IBM Rational ClearCase 7.0.0 before 7.0.0.4, and 7.0.1.1-RATL-RCC-IFIX02 and possibly other 7.0.1 versions before 7.0.1.3, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO of a URI associated with a VOB page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32957; http://securitytracker.com/id?1021295; http://www-01.ibm.com/support/docview.wss?uid=swg1PK70972
CVE: CVE-2008-5331
Published: 2008-12-05
Description: Adobe Acrobat 9 uses more efficient encryption than previous versions, which makes it easier for attackers to guess a document's password via a brute-force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://blogs.adobe.com/security/2008/12/acrobat_9_and_password_encrypt.html; http://www.elcomsoft.com/PR/apdfpr_081126_en.pdf; http://www.securityfocus.com/bid/32610
CVE: CVE-2007-6719
Published: 2008-12-05
Description: SQL injection vulnerability in Wiz-Ad 1.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/25819; http://www.securityfocus.com/bid/25819
CVE: CVE-2008-5332
Published: 2008-12-05
Description: Multiple PHP remote file inclusion vulnerabilities in Pie 0.5.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lib parameter to files in lib/action/ including (a) alias.php, (b) cancel.php, (c) context.php, (d) deadlinks.php, (e) delete.php, and others; and the (2) GLOBALS[pie][library_path] parameter to files in lib/share/ including (f) diff.php, (g) file.php, (h) locale.php, (i) mapfile.php, (j) page.php, and others.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4687; http://www.securityfocus.com/bid/32455; https://exchange.xforce.ibmcloud.com/vulnerabilities/46819
CVE: CVE-2008-5333
Published: 2008-12-05
Description: SQL injection vulnerability in members.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4691; http://www.securityfocus.com/bid/32458; https://exchange.xforce.ibmcloud.com/vulnerabilities/46822
CVE: CVE-2008-5334
Published: 2008-12-05
Description: PHP remote file inclusion vulnerability in includes/common.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4691; https://www.exploit-db.com/exploits/7218; http://securityreason.com/securityalert/4691
CVE: CVE-2008-5335
Published: 2008-12-05
Description: SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msg_send parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/50065; http://secunia.com/advisories/32781; http://securityreason.com/securityalert/4688
CVE: CVE-2008-5336
Published: 2008-12-05
Description: SQL injection vulnerability in index.php in WebStudio CMS allows remote attackers to execute arbitrary SQL commands via the pageid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4690; http://www.securityfocus.com/archive/1/498597/100/0/threaded; http://www.securityfocus.com/bid/32449
CVE: CVE-2008-5337
Published: 2008-12-05
Description: SQL injection vulnerability in lyrics.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4689; http://www.securityfocus.com/bid/32453; http://z0rlu.blogspot.com/2008/11/bandwebsite-15-sqlxss-multiple-remote.html
CVE: CVE-2008-5338
Published: 2008-12-05
Description: Cross-site scripting (XSS) vulnerability in info.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to inject arbitrary web script or HTML via the section parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4689; http://www.securityfocus.com/bid/32454; http://z0rlu.blogspot.com/2008/11/bandwebsite-15-sqlxss-multiple-remote.html
CVE: CVE-2008-2086
Published: 2008-12-05
Description: Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allow remote attackers to execute arbitrary code via a crafted jnlp file that modifies the (1) java.home, (2) java.ext.dirs, or (3) user.home System Properties, aka "Java Web Start File Inclusion" and CR 6694892.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5339
Published: 2008-12-05
Description: Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to perform network connections to unauthorized hosts via unknown vectors, aka CR 6727079.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
CVE: CVE-2008-5340
Published: 2008-12-05
Description: Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to gain privileges to access local files or applications via unknown vectors, aka 6727081.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5341
Published: 2008-12-05
Description: Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted JWS applications to obtain the pathname of the JWS cache and the application username via unknown vectors, aka CR 6727071.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9861&w=2
CVE: CVE-2008-5342
Published: 2008-12-05
Description: Unspecified vulnerability in the BasicService for Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted downloaded applications to cause local files to be displayed in the browser of the user of the untrusted application via unknown vectors, aka 6767668.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5343
Published: 2008-12-05
Description: Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR" and CR 6707535.
CVSS Score: 9.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5344
Published: 2008-12-05
Description: Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applets to read arbitrary files and make unauthorized network connections via unknown vectors related to applet classloading, aka 6716217.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
CVE: CVE-2008-5345
Published: 2008-12-05
Description: Unspecified vulnerability in Java Runtime Environment (JRE) with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier allows code that is loaded from a local filesystem to read arbitrary files and make unauthorized connections to localhost via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
CVE: CVE-2008-5346
Published: 2008-12-05
Description: Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 or earlier allows untrusted applets and applications to read arbitrary memory via a crafted ZIP file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
CVE: CVE-2008-5347
Published: 2008-12-05
Description: Multiple unspecified vulnerabilities in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier allow untrusted applets and applications to gain privileges via vectors related to access to inner classes in the (1) JAX-WS and (2) JAXB packages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9861&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3697&w=2
CVE: CVE-2008-5348
Published: 2008-12-05
Description: Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier, when using Kerberos authentication, allows remote attackers to cause a denial of service (OS resource consumption) via unknown vectors.
CVSS Score: 7.1 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5349
Published: 2008-12-05
Description: Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows remote attackers to cause a denial of service (CPU consumption) via a crafted RSA public key.
CVSS Score: 7.1 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
CVE: CVE-2008-5350
Published: 2008-12-05
Description: Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applications and applets to list the contents of the operating user's directory via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5351
Published: 2008-12-05
Description: Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier accepts UTF-8 encodings that are not the "shortest" form, which makes it easier for attackers to bypass protection mechanisms for other applications that rely on shortest-form UTF-8 encodings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5352
Published: 2008-12-05
Description: Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=759; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
CVE: CVE-2008-5353
Published: 2008-12-05
Description: The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
CVSS Score: 10.0 (HIGH)
References: http://blog.cr0.org/2009/05/write-once-own-everyone.html; http://landonf.bikemonkey.org/code/macosx/CVE-2008-5[PII_REDACTED]9.html; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html
CVE: CVE-2008-5354
Published: 2008-12-05
Description: Stack-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows locally-launched and possibly remote untrusted Java applications to execute arbitrary code via a JAR file with a long Main-Class manifest entry.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5355
Published: 2008-12-05
Description: The "Java Update" feature for Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the signature of the JRE that is downloaded, which allows remote attackers to execute arbitrary code via DNS man-in-the-middle attacks.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://osvdb.org/50498; http://secunia.com/advisories/37386; http://security.gentoo.org/glsa/glsa-200911-02.xml