CVE-2010-4476

Publication date 17 February 2011

Last updated 24 July 2024

Ubuntu priority

The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openjdk-6	11.10 oneiric	Fixed 6b22-1.10-0ubuntu1
	11.04 natty	Fixed 6b22-1.10-0ubuntu1
	10.10 maverick	Fixed 6b20-1.9.7-0ubuntu1
	10.04 LTS lucid	Fixed 6b20-1.9.7-0ubuntu1~10.04.1
	9.10 karmic	Fixed 6b20-1.9.7-0ubuntu1~9.10.1
	8.04 LTS hardy	Fixed 6b27-1.12.3-0ubuntu1~08.04.1
	6.06 LTS dapper	Not in release
openjdk-6b18	11.10 oneiric	Fixed 6b18-1.8.7-0ubuntu5
	11.04 natty	Fixed 6b18-1.8.7-0ubuntu5
	10.10 maverick	Fixed 6b18-1.8.7-0ubuntu2.1
	10.04 LTS lucid	Fixed 6b18-1.8.7-0ubuntu1~10.04.2
	9.10 karmic	Fixed 6b18-1.8.7-0ubuntu1~9.10.1
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
sun-java5	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	8.04 LTS hardy	Ignored
	6.06 LTS dapper	Ignored
sun-java6	11.10 oneiric	Not affected
	11.04 natty	Fixed 6.24-1build0.10.10.1
	10.10 maverick	Fixed 6.24-1build0.10.10.1
	10.04 LTS lucid	Fixed 6.24-1build0.10.04.1
	9.10 karmic	Fixed 6.24-1build0.9.10.1
	8.04 LTS hardy	Fixed 6.24-1build0.8.04.1
	6.06 LTS dapper	Not in release

References

Related Ubuntu Security Notices (USN)

USN-1079-1
OpenJDK 6 vulnerabilities
1 March 2011

USN-1079-2
OpenJDK 6 vulnerabilities
15 March 2011

USN-1079-3
OpenJDK 6 vulnerabilities
17 March 2011

CVE-2010-4476

Status

References

Related Ubuntu Security Notices (USN)

Other references