CVE-2011-4610
published 2014-02-10CVE-2011-4610: JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2…
PriorityP423medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
2.17%
80.3th percentile
JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service (infinite loop) via vectors related to a crafted UTF-8 and a "surrogate pair character" that is "at the boundary of an internal buffer."
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | jboss_communications_platform | <= 5.1 | — |
| redhat | jboss_enterprise_application_platform | <= 5.1.2 | — |
| redhat | jboss_enterprise_brms_platform | <= 5.1.0 | — |
| redhat | jboss_enterprise_web_platform | <= 5.1.2 | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hh9c-c3q8-gv72: JBoss Web, as used in Red Hat JBoss Communications Platform before 5
ghsa_unreviewed·2022-05-17
CVE-2011-4610 [MEDIUM] CWE-119 GHSA-hh9c-c3q8-gv72: JBoss Web, as used in Red Hat JBoss Communications Platform before 5
JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service (infinite loop) via vectors related to a crafted UTF-8 and a "surrogate pair character" that is "at the boundary of an internal buffer."
Red Hat
JBoss Web remote denial of service when surrogate pair character is placed at buffer boundary
vendor_redhat·2012-01-31·CVSS 5.0
CVE-2011-4610 [MEDIUM] JBoss Web remote denial of service when surrogate pair character is placed at buffer boundary
JBoss Web remote denial of service when surrogate pair character is placed at buffer boundary
JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service (infinite loop) via vectors related to a crafted UTF-8 and a "surrogate pair character" that is "at the boundary of an internal buffer."
Package: tomcat5 (Red Hat Enterprise Linux 5) - Not affected
Package: tomcat6 (Red Hat Enterprise Linux 6) - Not affected
Package: Security (Red Hat JBoss BRMS 5) - Affected
Package: tomcat5 (Red Hat JBoss Enterprise Web Server 1) - Not affected
Package: tomcat6 (Red Hat JBoss Enterprise Web Server 1) - Not affected
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2012-0074.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0075.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0076.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0077.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0078.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0325.htmlhttp://www.osvdb.org/78775http://www.securityfocus.com/bid/51829https://bugzilla.redhat.com/show_bug.cgi?id=767871http://rhn.redhat.com/errata/RHSA-2012-0074.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0075.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0076.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0077.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0078.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0325.htmlhttp://www.osvdb.org/78775http://www.securityfocus.com/bid/51829https://bugzilla.redhat.com/show_bug.cgi?id=767871
2014-02-10
Published