The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.

Project Subscriptions

Vendors Products
Enterprise Linux Subscribe
Jboss Enterprise Application Platform Subscribe
Jboss Enterprise Portal Platform Subscribe
Jboss Enterprise Web Platform Subscribe
Jboss Enterprise Web Server Subscribe
Jboss Soa Platform Subscribe
Network Satellite Subscribe
Rhel Extras Subscribe
Rhel Extras Sap Subscribe
Advisories
Source ID Title
Debian DSA Debian DSA DSA-2161-1 OpenJDK security update
Debian DSA Debian DSA DSA-2161-2 OpenJDK security update
Github GHSA Github GHSA GHSA-gvgc-rxmh-5hvw Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment
Ubuntu USN Ubuntu USN USN-1079-1 OpenJDK 6 vulnerabilities
Ubuntu USN Ubuntu USN USN-1079-2 OpenJDK 6 vulnerabilities
Ubuntu USN Ubuntu USN USN-1079-3 OpenJDK 6 vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
http://blog.fortify.com/blog/2011/02/08/Double-Trouble cve-icon cve-icon
http://blogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053926.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053934.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00004.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00010.html cve-icon cve-icon
http://marc.info/?l=bugtraq&m=129899347607632&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=129960314701922&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=130168502603566&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=130270785502599&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=130497132406206&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=130497185606818&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=130514352726432&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=131041767210772&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=132215163318824&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=133469267822771&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=133728004526190&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=134254866602253&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=134254957702612&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=136485229118404&w=2 cve-icon cve-icon
http://secunia.com/advisories/43048 cve-icon cve-icon
http://secunia.com/advisories/43280 cve-icon cve-icon
http://secunia.com/advisories/43295 cve-icon cve-icon
http://secunia.com/advisories/43304 cve-icon cve-icon
http://secunia.com/advisories/43333 cve-icon cve-icon
http://secunia.com/advisories/43378 cve-icon cve-icon
http://secunia.com/advisories/43400 cve-icon cve-icon
http://secunia.com/advisories/43659 cve-icon cve-icon
http://secunia.com/advisories/44954 cve-icon cve-icon
http://secunia.com/advisories/45022 cve-icon cve-icon
http://secunia.com/advisories/45555 cve-icon cve-icon
http://secunia.com/advisories/49198 cve-icon cve-icon
http://security.gentoo.org/glsa/glsa-201406-32.xml cve-icon cve-icon
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html cve-icon cve-icon
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ94423 cve-icon cve-icon
http://www-01.ibm.com/support/docview.wss?uid=swg1PM31983 cve-icon cve-icon
http://www-01.ibm.com/support/docview.wss?uid=swg21468358 cve-icon cve-icon
http://www.debian.org/security/2011/dsa-2161 cve-icon cve-icon
http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ cve-icon cve-icon
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html cve-icon cve-icon
http://www.ibm.com/support/docview.wss?uid=swg24029497 cve-icon cve-icon
http://www.ibm.com/support/docview.wss?uid=swg24029498 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2011:054 cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2011-0210.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2011-0211.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2011-0212.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2011-0213.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2011-0214.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2011-0282.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2011-0333.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2011-0334.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2011-0880.html cve-icon cve-icon
http://www.securitytracker.com/id?1025062 cve-icon cve-icon
http://www.vupen.com/english/advisories/2011/0365 cve-icon cve-icon
http://www.vupen.com/english/advisories/2011/0377 cve-icon cve-icon
http://www.vupen.com/english/advisories/2011/0379 cve-icon cve-icon
http://www.vupen.com/english/advisories/2011/0422 cve-icon cve-icon
http://www.vupen.com/english/advisories/2011/0434 cve-icon cve-icon
http://www.vupen.com/english/advisories/2011/0605 cve-icon cve-icon
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02720715&admit=109447627+1298159618320+28353475 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2010-4476 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12662 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12745 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14328 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14589 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19493 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2010-4476 cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2024-08-07T03:43:14.943Z

Reserved: 2010-12-06T00:00:00

Link: CVE-2010-4476

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2011-02-17T19:00:01.900

Modified: 2025-04-11T00:51:21.963

Link: CVE-2010-4476

cve-icon Redhat

Severity : Moderate

Publid Date: 2011-02-01T00:00:00Z

Links: CVE-2010-4476 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses