Vulnerability CVE-2011-0311
Published: 2011-09-02   Modified: 2012-02-13

Description:
The class file parser in IBM Java before 1.4.2 SR13 FP9, as used in IBM Runtimes for Java Technology 5.0.0 before SR13 and 6.0.0 before SR10, allows remote authenticated users to cause a denial of service (JVM segmentation fault, and possibly memory consumption or an infinite loop) via a crafted attribute length field in a class file, which triggers a buffer over-read.

Type:

CWE-119

 (Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial
Affected software
IBM -> JAVA 
IBM -> Runtimes for java technology 

 References:
https://www-304.ibm.com/support/docview.wss?uid=isg1PM42551
http://xforce.iss.net/xforce/xfdb/65189
http://www.redhat.com/support/errata/RHSA-2011-1265.html
http://www.redhat.com/support/errata/RHSA-2011-1159.html
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ89620
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ89602
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00004.html
Copyright 2024, cxsecurity.com

 

Back to Top