CVE-2008-5353
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier...
- Published
- Dec 5, 2008
- Updated
- Aug 7, 2024
- Assigning CNA
- mitre
- Evidence observed
- Dec 3, 2008
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:CHigh · next 30 days
- Percentile
- 99.7%
- Model date
- Nov 7, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
Sources
modules/exploits/multi/browser/java_calendar_deserialize.rb
Metasploit Framework modulesDeclared conditions
- platform: Java,Linux,OSX,Solaris,Windows($.exploit_multi/browser/java_calendar_deserialize.platform)
- verification: check_not_declared($.exploit_multi/browser/java_calendar_deserialize.check)
Landon Fuller · osx · May 20, 2009
sf · multiple · Dec 3, 2008
Metasploit · multiple · Sep 20, 2010
Metasploit · multiple · Jan 8, 2011
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.