{"id":"CVE-2011-3387","aliases":["EUVD-2011-3350","GHSA-c76f-h47x-j5r2","RHSA-2011:1159","RHSA-2011:1265"],"status":"published","title":"The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a...","description":"The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different vulnerability than CVE-2011-0311.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01763,"percentile":0.78187,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2011-09-02T23:00:00Z","modified":"2026-06-29T10:04:16Z","affected":[{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.4.2-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.4.2-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.4.2-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.4.2-ibm-javacomm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.4.2-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.4.2-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.4.2-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.4.2-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.4.2-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.4.2-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.4.2-ibm-javacomm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.4.2-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.4.2-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.4.2-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.4.2-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.4.2-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.4.2-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.4.2-ibm-javacomm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.4.2-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.4.2-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.4.2-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:4","package":"java-1.4.2-ibm-sap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10.sap-1jpp.1.el4_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:4","package":"java-1.4.2-ibm-sap-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10.sap-1jpp.1.el4_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:4","package":"java-1.4.2-ibm-sap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10.sap-1jpp.1.el4_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:4","package":"java-1.4.2-ibm-sap-javacomm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10.sap-1jpp.1.el4_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:4","package":"java-1.4.2-ibm-sap-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10.sap-1jpp.1.el4_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:5","package":"java-1.4.2-ibm-sap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10.sap-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:5","package":"java-1.4.2-ibm-sap-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10.sap-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:5","package":"java-1.4.2-ibm-sap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10.sap-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:5","package":"java-1.4.2-ibm-sap-javacomm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10.sap-1jpp.1.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:5","package":"java-1.4.2-ibm-sap-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2.13.10.sap-1jpp.1.el5"}]}],"bundled":8}],"products":[{"vendor":"ibm","product":"java"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/69641","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://www-304.ibm.com/support/docview.wss?uid=isg1PM42551","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1265.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3387","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c76f-h47x-j5r2"},{"url":"https://access.redhat.com/errata/RHSA-2011:1159","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"http://www.ibm.com/developerworks/java/jdk/alerts/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=702349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=706106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=706139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=706153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=706248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=711677","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1159.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0311","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0311","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0311","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0802","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0802","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0814","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0814","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0862","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0865","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0865","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0867","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0867","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0867","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0871","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0871","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-3387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=737128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-3387","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:1265","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1265.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-3387","description":"The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different vulnerability than CVE-2011-0311.","status":"published","published":"2011-09-02T23:00:00Z","modified":"2024-08-06T23:29:56.838Z","updated_at":"2026-11-02T14:35:36.968002Z"}],"euvd":[{"id":"EUVD-2011-3350","description":"The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different vulnerability than CVE-2011-0311.","status":"published","published":"2011-09-02T23:00:00Z","modified":"2024-08-06T23:29:56Z","updated_at":"2026-11-03T01:39:52.044449Z"}],"ghsa":[{"id":"GHSA-c76f-h47x-j5r2","title":"The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a...","description":"The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different vulnerability than CVE-2011-0311.","status":"published","published":"2022-05-17T01:53:27Z","modified":"2023-02-03T05:06:07Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:53:50.761362Z"}],"nvd":[{"id":"CVE-2011-3387","description":"The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different vulnerability than CVE-2011-0311.","status":"published","published":"2011-09-02T23:55:05.46Z","modified":"2026-06-16T23:33:12.207Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:09.988332Z"}],"osv":[{"id":"RHSA-2011:1159","title":"Red Hat Security Advisory: java-1.4.2-ibm security update","status":"published","published":"2024-09-13T07:07:22Z","modified":"2026-06-29T10:04:15Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2011:1265","title":"Red Hat Security Advisory: java-1.4.2-ibm-sap security update","status":"published","published":"2024-09-13T07:07:48Z","modified":"2026-06-29T10:04:16Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}