CVE-2010-4476

Description

The `Double.parseDouble` method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308. Apache Tomcat introduced workarounds to avoid being affected by this issue in versions 7.0.7, 6.0.32, and 5.5.33.

How to fix CVE-2010-4476

To remediate CVE-2010-4476, upgrade the affected package to a fixed version below.

• —upgrade to 6b18-1.8.3-2+squeeze1 or later
• —upgrade to 6b18-1.8.3-2~lenny1 or later
• —upgrade to 7.0.7 or later

Is CVE-2010-4476 being exploited?

Moderate — EPSS is 39.9%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (3)

• from 0, < 6b18-1.8.3-2+squeeze1
• from 0, < 6b18-1.8.3-2~lenny1
• >= 7.0.0, < 7.0.7

References (60)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2010-4476
• PATCHgithub.com/apache/tomcat
• WEBblog.fortify.com/blog/2011/02/08/Double-Trouble
• WEBblogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html