The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-2161-1 | OpenJDK security update |
Debian DSA |
DSA-2161-2 | OpenJDK security update |
Github GHSA |
GHSA-gvgc-rxmh-5hvw | Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment |
Ubuntu USN |
USN-1079-1 | OpenJDK 6 vulnerabilities |
Ubuntu USN |
USN-1079-2 | OpenJDK 6 vulnerabilities |
Ubuntu USN |
USN-1079-3 | OpenJDK 6 vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Status: PUBLISHED
Assigner: oracle
Published:
Updated: 2024-08-07T03:43:14.943Z
Reserved: 2010-12-06T00:00:00
Link: CVE-2010-4476
No data.
Status : Deferred
Published: 2011-02-17T19:00:01.900
Modified: 2025-04-11T00:51:21.963
Link: CVE-2010-4476
OpenCVE Enrichment
No data.
Debian DSA
Github GHSA
Ubuntu USN