Read the docs
TI-2011-02997 Aliases CVE-2011-3387GHSA-c76f-h47x-j5r2

The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to…

Priority LOW 22CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different vulnerability than CVE-2011-0311.

Why it matters now

EPSS 0.01763 78th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ibm:java:1.4.2.13.9:*:*:*:*:*:*:*1.4.2.13.9VulnerableIBM
  • cpe:2.3:a:ibm:java:1.4.2.13.9:*:*:*:*:*:*:* Versions 1.4.2.13.9 Vulnerable ·IBM

Remediation

Red Hat 2 advisories

  • RHSA-2011:1265 Released 2011-09-06 · Red Hat rating Moderate
    java-1.4.2-ibm-sap security update
    • RHEL 4 AS for SAP java-1.4.2-ibm-sap-1.4.2.13.10.sap-1jpp.1.el4_8, java-1.4.2-ibm-sap-demo-1.4.2.13.10.sap-1jpp.1.el4_8, java-1.4.2-ibm-sap-devel-1.4.2.13.10.sap-1jpp.1.el4_8 +2
    • RHEL 5 Server for SAP java-1.4.2-ibm-sap-1.4.2.13.10.sap-1jpp.1.el5, java-1.4.2-ibm-sap-demo-1.4.2.13.10.sap-1jpp.1.el5, java-1.4.2-ibm-sap-devel-1.4.2.13.10.sap-1jpp.1.el5 +2
  • RHSA-2011:1159 Released 2011-08-15 · Red Hat rating Critical
    java-1.4.2-ibm security update
    • Red Hat Desktop version 4 Extras java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4.i386, java-1.4.2-ibm-demo-1.4.2.13.10-1jpp.1.el4 +9
    • Red Hat Enterprise Linux AS version 4 Extras java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4.ia64 +20
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el5, java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el5.i386, java-1.4.2-ibm-demo-1.4.2.13.10-1jpp.1.el5 +9
    • Red Hat Enterprise Linux ES version 4 Extras java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4.ia64 +13
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el5, java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el5.i386, java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el5.ia64 +20
    • Red Hat Enterprise Linux WS version 4 Extras java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.10-1jpp.1.el4.ia64 +13

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL 4 AS for SAPFixed RHSA-2011:1265
RHEL 5 Server for SAPFixed RHSA-2011:1265
Red Hat Desktop version 4 ExtrasFixed RHSA-2011:1159
Red Hat Enterprise Linux AS version 4 ExtrasFixed RHSA-2011:1159
Red Hat Enterprise Linux Desktop Supplementary (v. 5)Fixed RHSA-2011:1159
Red Hat Enterprise Linux ES version 4 ExtrasFixed RHSA-2011:1159
Red Hat Enterprise Linux Server Supplementary (v. 5)Fixed RHSA-2011:1159
Red Hat Enterprise Linux WS version 4 ExtrasFixed RHSA-2011:1159

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-3387
  2. 2026-10-03 Alias added: GHSA-c76f-h47x-j5r2

References

Advisory 2

  • TI-2015-00164 Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6… CVSS 3.1CRITICAL 9.8
  • TI-2013-03496 XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime… CVSS 2.0HIGH 7.1
  • TI-2012-04075 Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1… CVSS 2.0HIGH 9.3
  • TI-2012-04074 Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier… CVSS 2.0HIGH 9.3
  • TI-2012-04073 Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier… CVSS 2.0HIGH 9.3
  • TI-2013-04656 Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0… CVSS 2.0HIGH 9.3
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences