CVE-2008-3108

Name: CVE-2008-3108
Creator: NVD / NIST
Published: 2008-07-09T23:41:00+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 4.61%

Last modified Jun 16, 2026

CVE-2008-3108 is a vulnerability of currently unknown severity. Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing.. EPSS estimates a 4.61% chance of exploitation in the next 30 days.

Description

Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing.

Metrics

EPSS Probability

4.61%

90.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-119

Affected Software

Vendor	Product	Versions
Sun	Jre	1.3.1
Sun	Jre	1.3.1_2
Sun	Jre	1.3.1_03
Sun	Jre	1.3.1_04
Sun	Jre	1.3.1_05
Sun	Jre	1.3.1_06
Sun	Jre	1.3.1_07
Sun	Jre	1.3.1_08
Sun	Jre	1.3.1_09
Sun	Jre	1.3.1_10
Sun	Jre	1.3.1_11
Sun	Jre	1.3.1_12
Sun	Jre	1.3.1_13
Sun	Jre	1.3.1_14
Sun	Jre	1.3.1_15
Sun	Jre	1.3.1_16
Sun	Jre	1.3.1_17
Sun	Jre	1.3.1_18
Sun	Jre	1.3.1_19
Sun	Jre	1.3.1_20
Sun	Jre	1.3.1_21
Sun	Jre	1.3.1_22
Sun	Jre	1.3.1_23
Sun	Jre	1.4.2
Sun	Jre	1.4.2_1
Sun	Jre	1.4.2_2
Sun	Jre	1.4.2_3
Sun	Jre	1.4.2_4
Sun	Jre	1.4.2_5
Sun	Jre	1.4.2_6
Sun	Jre	1.4.2_7
Sun	Jre	1.4.2_8
Sun	Jre	1.4.2_9
Sun	Jre	1.4.2_10
Sun	Jre	1.4.2_11
Sun	Jre	1.4.2_12
Sun	Jre	1.4.2_13
Sun	Jre	1.4.2_14
Sun	Jre	1.4.2_15
Sun	Jre	1.4.2_16
Sun	Jre	1.4.2_17
Sun	Jre	1.4.2_18
Sun	Jre	1.5.0
Sun	Jdk	1.5.0
Sun	Sdk	1.3.1
Sun	Sdk	1.3.1_01
Sun	Sdk	1.3.1_01a
Sun	Sdk	1.3.1_02
Sun	Sdk	1.3.1_03
Sun	Sdk	1.3.1_04

Showing 50 of 93 affected configurations. See NVD for the full list.

References

http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00002.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=122331139823057&w=2Mailing List, Third Party Advisory
http://secunia.com/advisories/31010Third Party Advisory
http://secunia.com/advisories/31320Third Party Advisory
http://secunia.com/advisories/31497Third Party Advisory
http://secunia.com/advisories/31600Third Party Advisory
http://secunia.com/advisories/31736Third Party Advisory
http://secunia.com/advisories/32018Third Party Advisory
http://secunia.com/advisories/32179Third Party Advisory
http://secunia.com/advisories/32180Third Party Advisory
http://secunia.com/advisories/33236Third Party Advisory
http://secunia.com/advisories/33237Third Party Advisory
http://secunia.com/advisories/37386Third Party Advisory
http://security.gentoo.org/glsa/glsa-200911-02.xmlThird Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-238666-1Broken Link
http://support.apple.com/kb/HT3178Third Party Advisory
http://support.apple.com/kb/HT3179Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2008-300.htmThird Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2008-507.htmThird Party Advisory
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=751014Third Party Advisory
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=756717Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-0790.htmlThird Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-1043.htmlThird Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-1044.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/497041/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/30147Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1020461Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-193A.htmlThird Party Advisory, US Government Resource
http://www.vmware.com/security/advisories/VMSA-2008-0016.htmlThird Party Advisory
http://www.vupen.com/english/advisories/2008/2056/referencesThird Party Advisory
http://www.vupen.com/english/advisories/2008/2740Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43656VDB Entry
http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00002.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=122331139823057&w=2Mailing List, Third Party Advisory
http://secunia.com/advisories/31010Third Party Advisory
http://secunia.com/advisories/31320Third Party Advisory
http://secunia.com/advisories/31497Third Party Advisory
http://secunia.com/advisories/31600Third Party Advisory
http://secunia.com/advisories/31736Third Party Advisory
http://secunia.com/advisories/32018Third Party Advisory
http://secunia.com/advisories/32179Third Party Advisory
http://secunia.com/advisories/32180Third Party Advisory
http://secunia.com/advisories/33236Third Party Advisory
http://secunia.com/advisories/33237Third Party Advisory
http://secunia.com/advisories/37386Third Party Advisory
http://security.gentoo.org/glsa/glsa-200911-02.xmlThird Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-238666-1Broken Link
http://support.apple.com/kb/HT3178Third Party Advisory
http://support.apple.com/kb/HT3179Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2008-300.htmThird Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2008-507.htmThird Party Advisory
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=751014Third Party Advisory
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=756717Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-0790.htmlThird Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-1043.htmlThird Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-1044.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/497041/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/30147Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1020461Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-193A.htmlThird Party Advisory, US Government Resource
http://www.vmware.com/security/advisories/VMSA-2008-0016.htmlThird Party Advisory
http://www.vupen.com/english/advisories/2008/2056/referencesThird Party Advisory
http://www.vupen.com/english/advisories/2008/2740Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43656VDB Entry

Timeline

Published: Jul 9, 2008
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2008-3108?

How severe is CVE-2008-3108?

Severity scoring for CVE-2008-3108 is pending analysis. The EPSS model estimates a 4.61% probability of exploitation in the next 30 days.

How do I fix CVE-2008-3108?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2008-3108?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST