CVE-2011-5035
NoneCVSS
—
EPSS
68.2%
Published
Dec 30, 2011
CISA due date
—
The record
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:6.0 | openjdk-6 | 0 | 6b18-1.8.13-0+squeeze1 |
| Red Hat:enterprise_linux:5::client | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::client | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::client | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::client | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::client | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::client | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:5::server | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::client | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::computenode | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::server | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk-debuginfo | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk-demo | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk-devel | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk-javadoc | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:enterprise_linux:6::workstation | java-1.6.0-openjdk-src | 0 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
| Red Hat:network_satellite:5.4::el5 | java-1.6.0-ibm | 0 | 1:1.6.0.14.0-1jpp.1.el5_9 |
| Red Hat:network_satellite:5.4::el5 | java-1.6.0-ibm-devel | 0 | 1:1.6.0.14.0-1jpp.1.el5_9 |
| Red Hat:network_satellite:5.4::el6 | java-1.6.0-ibm | 0 | 1:1.6.0.14.0-1jpp.1.el6_4 |
| Red Hat:network_satellite:5.4::el6 | java-1.6.0-ibm-devel | 0 | 1:1.6.0.14.0-1jpp.1.el6_4 |
| Red Hat:rhel_extras:4 | java-1.6.0-sun | 0 | 1:1.6.0.31-1jpp.1.el4 |
| Red Hat:rhel_extras:4 | java-1.6.0-sun-demo | 0 | 1:1.6.0.31-1jpp.1.el4 |
| Red Hat:rhel_extras:4 | java-1.6.0-sun-devel | 0 | 1:1.6.0.31-1jpp.1.el4 |
| Red Hat:rhel_extras:4 | java-1.6.0-sun-jdbc | 0 | 1:1.6.0.31-1jpp.1.el4 |
| Red Hat:rhel_extras:4 | java-1.6.0-sun-plugin | 0 | 1:1.6.0.31-1jpp.1.el4 |
| Red Hat:rhel_extras:4 | java-1.6.0-sun-src | 0 | 1:1.6.0.31-1jpp.1.el4 |
| Red Hat:rhel_extras:5::client | java-1.6.0-ibm | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-ibm-accessibility | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-ibm-demo | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-ibm-devel | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-ibm-javacomm | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-ibm-jdbc | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-ibm-plugin | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-ibm-src | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-sun | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-sun-demo | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-sun-devel | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-sun-jdbc | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-sun-plugin | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::client | java-1.6.0-sun-src | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-accessibility | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-demo | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-devel | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-javacomm | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-jdbc | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-plugin | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-ibm-src | 0 | 1:1.6.0.10.1-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun-demo | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun-devel | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun-jdbc | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun-plugin | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:5::server | java-1.6.0-sun-src | 0 | 1:1.6.0.31-1jpp.1.el5 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm | 0 | 1:1.6.0.10.1-1jpp.5.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-demo | 0 | 1:1.6.0.10.1-1jpp.5.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-devel | 0 | 1:1.6.0.10.1-1jpp.5.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-javacomm | 0 | 1:1.6.0.10.1-1jpp.5.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-jdbc | 0 | 1:1.6.0.10.1-1jpp.5.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-plugin | 0 | 1:1.6.0.10.1-1jpp.5.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-ibm-src | 0 | 1:1.6.0.10.1-1jpp.5.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun | 0 | 1:1.6.0.31-1jpp.1.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun-demo | 0 | 1:1.6.0.31-1jpp.1.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun-devel | 0 | 1:1.6.0.31-1jpp.1.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun-jdbc | 0 | 1:1.6.0.31-1jpp.1.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun-plugin | 0 | 1:1.6.0.31-1jpp.1.el6_2 |
| Red Hat:rhel_extras:6 | java-1.6.0-sun-src | 0 | 1:1.6.0.31-1jpp.1.el6_2 |
| openSUSE:Tumbleweed | java-1_7_0-openjdk | 0 | 1.7.0.121-1.1 |
Related vulnerabilities
- CVE-2015-8472 Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x… Also affects openjdk-6
- CVE-2016-0483 Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65… Also affects openjdk-6
- CVE-2015-7575 Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before… Also affects openjdk-6
- CVE-2015-8126 Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in… Also affects openjdk-6
- CVE-2015-4734 Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded… Also affects openjdk-6
- CVE-2015-4748 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and… Also affects openjdk-6
- CVE-2015-2590 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… Also affects openjdk-6
- CVE-2015-4000 The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server… Also affects openjdk-6