Description
The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different vulnerability than CVE-2011-0311.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.13.10-1jpp.1.el5 | RHSA-2011:1159 |
| RHEL 5 | java-1.4.2-ibm-sap +4 | 1.4.2.13.10.sap-1jpp.1.el5 | RHSA-2011:1265 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.13.10-1jpp.1.el4 | RHSA-2011:1159 |
| RHEL 4 | java-1.4.2-ibm-sap +4 | 1.4.2.13.10.sap-1jpp.1.el4_8 | RHSA-2011:1265 |
Advisories 2
- RHSA-2011:1265 Red Hat Security Advisory: java-1.4.2-ibm-sap security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:1159 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- ibm-java-class-file-dos(69641) vdb-entry
- PM42551 vendor-advisory
- RHSA-2011:1265 vendor-advisory