CVE-2010-4476

描述

The `Double.parseDouble` method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308. Apache Tomcat introduced workarounds to avoid being affected by this issue in versions 7.0.7, 6.0.32, and 5.5.33.

如何修補 CVE-2010-4476

要修補 CVE-2010-4476,請將受影響套件升級到下列已修補版本。

• —升級至 6b18-1.8.3-2+squeeze1 或更新版本
• —升級至 6b18-1.8.3-2~lenny1 或更新版本
• —升級至 7.0.7 或更新版本

CVE-2010-4476 正在被利用嗎?

中等 — EPSS 為 23.5%,可持續追蹤但非最高優先。

受影響套件(3)

• from 0, < 6b18-1.8.3-2+squeeze1
• from 0, < 6b18-1.8.3-2~lenny1
• >= 7.0.0, < 7.0.7

參考連結(60)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2010-4476
• PATCHgithub.com/apache/tomcat
• WEBblog.fortify.com/blog/2011/02/08/Double-Trouble
• WEBblogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html