Sun Java JRE Multiple Vulnerabilities (233321-233327)

High Nessus Plugin ID 31356


The remote Windows host has an application that is affected by multiple vulnerabilities.


The version of Sun Java Runtime Environment (JRE) installed on the remote host is affected by one or more security issues :

- Two vulnerabilities in the JRE VM may independently allow an untrusted application or applet downloaded from a website to elevate its privileges (233321).

- When processing XSLT transformations, an untrusted application or applet downloaded from a website may be able to elevate its privileges or cause the JRE to crash (233322).

- Three buffer overflows exist in Java Web Start (233323).

- A vulnerability in the Java Plug-in may allow an applet download from a website to bypass the same origin policy and execute local applications (233324).

- Multiple vulnerabilities in the JRE Image Processing library may allow an untrusted application or applet to elevate its privileges or cause the JRE to crash (233325).

- A vulnerability in the JRE may allow untrusted JavaScript code to elevate its privileges through Java APIs (233326).

- An as-yet unspecified buffer overflow exists in Java Web Start (233327).


Upgrade to Sun JDK and JRE 6 Update 5 / JDK and JRE 5.0 Update 15 / SDK and JRE 1.4.2_17 or later and remove, if necessary, any other affected versions.

See Also

Plugin Details

Severity: High

ID: 31356

File Name: sun_java_jre_233321.nasl

Version: $Revision: 1.23 $

Type: local

Agent: windows

Family: Windows

Published: 2008/03/06

Modified: 2018/01/22

Dependencies: 33545

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C


Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:oracle:jre

Required KB Items: SMB/Java/JRE/Installed

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2008/03/04

Reference Information

CVE: CVE-2008-1193

BID: 28083, 28125

OSVDB: 42598

Secunia: 29239

CWE: 264