CVEvulnerability
CVE-2008-0628
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-02-06
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.8 HIGH — AV:N/AC:M/Au:N/C:N/I:P/A:C
- Weaknesses
- CWE-264
Description
The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources.
Affected configurations
• sun jdk 1.6
• sun jre (<= 1.6.0)
Related
Weakness · not in database (1)
References
- http://dev2dev.bea.com/pub/advisory/277 dev2dev.bea.com
- http://scary.beasts.org/security/CESA-2007-002.html scary.beasts.org
- http://secunia.com/advisories/28746 Patch, Vendor Advisory
- http://secunia.com/advisories/29841 secunia.com
- http://secunia.com/advisories/29858 secunia.com
- http://secunia.com/advisories/30780 secunia.com
- http://security.gentoo.org/glsa/glsa-200804-28.xml security.gentoo.org
- http://securityreason.com/securityalert/3621 securityreason.com
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-231246-1 sunsolve.sun.com
- http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml www.gentoo.org
- http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml www.gentoo.org
- http://www.redhat.com/support/errata/RHSA-2008-0245.html www.redhat.com
- http://www.securityfocus.com/archive/1/487434/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/27553 www.securityfocus.com
- http://www.securitytracker.com/id?1019292 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/0371 www.vupen.com
- http://www.vupen.com/english/advisories/2008/1252 www.vupen.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9847 oval.cisecurity.org
- http://dev2dev.bea.com/pub/advisory/277 dev2dev.bea.com
- http://scary.beasts.org/security/CESA-2007-002.html scary.beasts.org
- http://secunia.com/advisories/28746 Patch, Vendor Advisory
- http://secunia.com/advisories/29841 secunia.com
- http://secunia.com/advisories/29858 secunia.com
- http://secunia.com/advisories/30780 secunia.com
- http://security.gentoo.org/glsa/glsa-200804-28.xml security.gentoo.org
- http://securityreason.com/securityalert/3621 securityreason.com
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-231246-1 sunsolve.sun.com
- http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml www.gentoo.org
- http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml www.gentoo.org
- http://www.redhat.com/support/errata/RHSA-2008-0245.html www.redhat.com
- http://www.securityfocus.com/archive/1/487434/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/27553 www.securityfocus.com
- http://www.securitytracker.com/id?1019292 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/0371 www.vupen.com
- http://www.vupen.com/english/advisories/2008/1252 www.vupen.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9847 oval.cisecurity.org