NetSight
IP …
medium5.0Public exploit code

CVE-2010-4476

The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.

Affected products

VendorProductAffected versions
SunJre
through 1.6.0
through 1.5.0
through 1.4.2_29
Versions 1.6.0, 1.5.0, 1.4.2
SunJdk
through 1.6.0
through 1.5.0
Versions 1.6.0, 1.5.0
SunSdk
through 1.4.2_29
Versions 1.4.2, 1.4.2_1, 1.4.2_02, 1.4.2_3, 1.4.2_4

References