HOME VULNERABILITIESCVE-2008-1189

MEDIUM

CVE-2008-1189

CWE-119Published: March 6, 2008· Updated: Jun 16, 2026

6.8

CVSS v3.1

Official Description

Buffer overflow in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different issue than CVE-2008-1188, aka the "third" issue.

Technical Analysis

CVE-2008-1189 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityM

Privileges Req.

User Interaction

Scope

Impact

ConfidentialityP

IntegrityP

AvailabilityP

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected Vendors & Products

sun3 product(s)

jdkjresdk

Source: NVD CPE · 38 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-233323-1

PATCHhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-233323-1

ADVISORYhttp://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html

ADVISORYhttp://secunia.com/advisories/29239

ADVISORYhttp://secunia.com/advisories/29273

ADVISORYhttp://secunia.com/advisories/29498

ADVISORYhttp://secunia.com/advisories/29582

ADVISORYhttp://secunia.com/advisories/29858

ADVISORYhttp://secunia.com/advisories/29897

ADVISORYhttp://secunia.com/advisories/30676

ADVISORYhttp://secunia.com/advisories/30780

ADVISORYhttp://secunia.com/advisories/31497

ADVISORYhttp://secunia.com/advisories/32018

ADVISORYhttp://security.gentoo.org/glsa/glsa-200804-28.xml

ADVISORYhttp://support.apple.com/kb/HT3178

ADVISORYhttp://support.apple.com/kb/HT3179

ADVISORYhttp://www.gentoo.org/security/en/glsa/glsa-200804-20.xml

ADVISORYhttp://www.gentoo.org/security/en/glsa/glsa-200806-11.xml

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2008-0186.html

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2008-0210.html

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2008-0267.html

ADVISORYhttp://www.securitytracker.com/id?1019549

ADVISORYhttp://www.us-cert.gov/cas/techalerts/TA08-066A.html

ADVISORYhttp://www.vmware.com/security/advisories/VMSA-2008-0010.html

ADVISORYhttp://www.vupen.com/english/advisories/2008/0770/references

ADVISORYhttp://www.vupen.com/english/advisories/2008/1856/references

ADVISORYhttps://exchange.xforce.ibmcloud.com/vulnerabilities/41029

ADVISORYhttps://exchange.xforce.ibmcloud.com/vulnerabilities/41133

ADVISORYhttps://exchange.xforce.ibmcloud.com/vulnerabilities/41135

ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9582

ADVISORYhttp://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html

ADVISORYhttp://secunia.com/advisories/29239

ADVISORYhttp://secunia.com/advisories/29273

ADVISORYhttp://secunia.com/advisories/29498

ADVISORYhttp://secunia.com/advisories/29582

ADVISORYhttp://secunia.com/advisories/29858

ADVISORYhttp://secunia.com/advisories/29897

ADVISORYhttp://secunia.com/advisories/30676

ADVISORYhttp://secunia.com/advisories/30780

ADVISORYhttp://secunia.com/advisories/31497

ADVISORYhttp://secunia.com/advisories/32018

ADVISORYhttp://security.gentoo.org/glsa/glsa-200804-28.xml

ADVISORYhttp://support.apple.com/kb/HT3178

ADVISORYhttp://support.apple.com/kb/HT3179

ADVISORYhttp://www.gentoo.org/security/en/glsa/glsa-200804-20.xml

ADVISORYhttp://www.gentoo.org/security/en/glsa/glsa-200806-11.xml

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2008-0186.html

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2008-0210.html

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2008-0267.html

ADVISORYhttp://www.securitytracker.com/id?1019549

ADVISORYhttp://www.us-cert.gov/cas/techalerts/TA08-066A.html

ADVISORYhttp://www.vmware.com/security/advisories/VMSA-2008-0010.html

ADVISORYhttp://www.vupen.com/english/advisories/2008/0770/references

ADVISORYhttp://www.vupen.com/english/advisories/2008/1856/references

ADVISORYhttps://exchange.xforce.ibmcloud.com/vulnerabilities/41029

ADVISORYhttps://exchange.xforce.ibmcloud.com/vulnerabilities/41133

ADVISORYhttps://exchange.xforce.ibmcloud.com/vulnerabilities/41135

ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9582

All References (62)

→

http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.htmlMailing List · Third Party Advisory

→

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.htmlMailing List · Third Party Advisory

→

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.htmlMailing List · Third Party Advisory

→

http://secunia.com/advisories/29239Third Party Advisory

→

http://secunia.com/advisories/29273Third Party Advisory

→

http://secunia.com/advisories/29498Third Party Advisory

→

http://secunia.com/advisories/29582Third Party Advisory

→

http://secunia.com/advisories/29858Third Party Advisory

→

http://secunia.com/advisories/29897Third Party Advisory

→

http://secunia.com/advisories/30676Third Party Advisory

→

http://secunia.com/advisories/30780Third Party Advisory

→

http://secunia.com/advisories/31497Third Party Advisory

→

http://secunia.com/advisories/32018Third Party Advisory

→

http://security.gentoo.org/glsa/glsa-200804-28.xmlThird Party Advisory

→

http://sunsolve.sun.com/search/document.do?assetkey=1-26-233323-1Patch · Third Party Advisory

Quick Facts

CVE IDCVE-2008-1189

CVSS Score6.8 / 10

SeverityMEDIUM

WeaknessCWE-119

CISA KEVNo

Affected1 vendor(s)

PublishedMar 6, 2008

Related CVEs (CWE-119)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2008-1189 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWatch. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2008-1189·NVD