| Vulnerability Name: | CCN-11561 | ||||||
| Published: | 2003-03-14 | ||||||
| Updated: | 2003-03-14 | ||||||
| Summary: | Sun JDK (Java Development Kit) is vulnerable to multiple denial of service attacks, caused by integer overflows in multiple system classes including, java.util.zip.Adler32().update(), java.util.zip.Deflater().setDictionary(), java.util.zip.CRC32().update(), java.util.zip.Deflater().deflate(), java.util.zip.CheckedOutputStream().write(), and java.util.zip.CheckedInputStream().read(). A remote attacker could create a malicious Java Applet, which could then be used to bypass any Java security restrictions and cause the local Java environment to crash. An attacker could exploit this vulnerability by hosting the malicious Java Applet on a Web site or by sending it to a potential victim within an HTML email. | ||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
| ||||||
| CVSS v2 Severity: | 5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
| ||||||
| Vulnerability Consequences: | Denial of Service | ||||||
| References: | Source: CCN Type: BugTraq Mailing List, Fri Mar 14 2003 - 17:20:47 CST Denial-Of-Service holes in JDK 1.4.1_01 Source: CCN Type: BugTraq Mailing List, Tue Apr 29 2003 - 10:52:53 CDT Coldfusion MX: Java in CFM causes Crash Source: CCN Type: VulnWatch Mailing List, Sun Apr 06 2003 - 16:11:27 CDT Java Agent freezes Lotus Notes and Domino 6.0.1 (fwd) Source: CCN Type: VulnWatch Mailing List, Sat May 10 2003 - 18:48:54 CDT Opera 7.11 java.util.zip.* Vulnerability (fwd) Source: CCN Type: Sun Microsystems Web site The Source for Java Technology Source: CCN Type: BID-7109 Multiple Vendor Java Virtual Machine java.util.zip Null Value Denial Of Service Vulnerability Source: XF Type: UNKNOWN jdk-systemclass-integer-overflow(11561) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||