CVE-2011-4610

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-02-10 · updated 2026-06-16
Weakness: CWE-119

Description

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service (infinite loop) via vectors related to a crafted UTF-8 and a "surrogate pair character" that is "at the boundary of an internal buffer."

Affected products

RedHat Jboss Communications Platform: through 5.1
Red Hat JBoss EAP: through 5.1.2
RedHat Jboss Enterprise Brms Platform: through 5.1.0
RedHat Jboss Enterprise Web Platform: through 5.1.2

References

http://rhn.redhat.com/errata/RHSA-2012-0074.html
http://rhn.redhat.com/errata/RHSA-2012-0075.html
http://rhn.redhat.com/errata/RHSA-2012-0076.html
http://rhn.redhat.com/errata/RHSA-2012-0077.html
http://rhn.redhat.com/errata/RHSA-2012-0078.html
http://rhn.redhat.com/errata/RHSA-2012-0325.html
http://www.osvdb.org/78775
http://www.securityfocus.com/bid/51829
https://bugzilla.redhat.com/show_bug.cgi?id=767871
http://rhn.redhat.com/errata/RHSA-2012-0074.html
http://rhn.redhat.com/errata/RHSA-2012-0075.html
http://rhn.redhat.com/errata/RHSA-2012-0076.html

Get alerted when CVE-2011-4610 or the next vulnerability affects your stack