PT-2012-5957 · Oracle+1 · Oracle Java Se+1

Jan Lieskovsky · Publicado 2012-11-28 · Atualizado 2017-08-29 · CVE-2012-5373

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions prior to 8 OpenJDK versions prior to 8

Description The issue allows context-dependent attackers to cause a denial of service via crafted input to an application that maintains a hash table. This is demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.

Recommendations For Oracle Java SE versions prior to 8, update to version 8 or later to resolve the issue. For OpenJDK versions prior to 8, update to version 8 or later to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-5373

Produtos afetados

Openjdk

Oracle Java Se

Referências · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2012-5373 · Aviso do Fabricante
• http://securityfocus.com/bid/56673 · Nota
• http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/d9564350faa6/patches/security/20121016/7158800.patch · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5373 · Nota de Segurança
• http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html · Nota
• http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8006593 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80299 · Nota
• http://ocert.org/advisories/ocert-2012-001.html · Nota
• http://2012.appsec-forum.ch/conferences/#c17 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=880705 · Nota
• https://ubuntu.com/security/CVE-2012-5373 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2012-5373 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5373 · Nota
• https://131002.net/data/talks/appsec12_slides.pdf · Nota
• http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf · Nota