Oracle Security Alert for CVE-2010-4476

Description

This Security Alert addresses security issue CVE-2010-4476 (Java Runtime Environment hangs when converting "2.2250738585072012e-308" to a binary floating-point number), which is a vulnerability in the Java Runtime Environment component of the Oracle Java SE and Java for Business products and Oracle JRockit. This vulnerability allows unauthenticated network attacks ( i.e. it may be exploited over a network without the need for a username and password). Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete Denial of Service) of the Java Runtime Environment. Java based application and web servers are especially at risk from this vulnerability.

Supported Products Affected

The security vulnerability addressed by this Security Alert affects the products listed in the categories below.  Please click on the link in the Patch Availability Table to access the documentation for those patches.

Affected product releases and versions:

Patch Availability Table

References

• Oracle Critical Patch Updates and Security Alerts main page [ Oracle Technology Network ]
• Oracle Critical Patch Updates and Security Alerts - Frequently Asked Questions [ CPU FAQ ]
• Risk Matrix definitions [ Risk Matrix Definitions ]
• Use of Common Vulnerability Scoring System (CVSS) by Oracle [ Oracle CVSS Scoring ]
• English text version of risk matrix [ Oracle Technology Network ]
• Previous Security Advisories for Java SE and Java for Business Security Updates [ Java Sun Alerts Archive Page ]

Modification History

Risk Matrix for Oracle Java SE and Java for Business and Oracle JRockit

My Oracle Support Note 360870.1 explains the impact of Java security vulnerabilities on Oracle products that include a JDK.