Unscored severity · published Sep 2, 2011
CVE-2011-0311
The class file parser in IBM Java before 1.4.2 SR13 FP9, as used in IBM Runtimes for Java Technology 5.0.0 before SR13 and 6.0.0 before SR10, allows remote authenticated users to…
–
CVSS
1.8%
EPSS
No
On KEV
Description
The class file parser in IBM Java before 1.4.2 SR13 FP9, as used in IBM Runtimes for Java Technology 5.0.0 before SR13 and 6.0.0 before SR10, allows remote authenticated users to cause a denial of service (JVM segmentation fault, and possibly memory consumption or an infinite loop) via a crafted attribute length field in a class file, which triggers a buffer over-read.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Java · Ibm
through 1.4.2.13.8; 1.4.2; 1.4.2.13; 1.4.2.13.1; 1.4.2.13.2; 1.4.2.13.3; +4 more · source: NVD
RF
Runtimes For Java Technology · Ibm
through 5.0.12.4; through 6.0.9.0; 5.0.0; 5.0.11.0; 5.0.11.1; 5.0.11.2; +14 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0311
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0311
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00004.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00010.html
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ89602
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ89620
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2011-1159.html
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2011-1265.html
More from Java
9.8
CVE-2015-0192
Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to…
7.8
CVE-2019-4473
Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by…
7.5
CVE-2023-30441
IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and…
7.5
CVE-2015-1916
Unspecified vulnerability in IBM Java 8 before SR1 allows remote attackers to cause a denial of service via unknown vectors related to SSL/TLS and the Secure Socket Extension…
–
CVE-2015-1914
IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to bypass "permission checks" and obtain sensitive…