Описание
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:o:microsoft:windows_nt:4.0:*:enterprise_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:*:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:*:terminal_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp1:enterprise_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp1:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp1:terminal_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp2:enterprise_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp2:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp2:terminal_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp3:enterprise_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp3:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp3:terminal_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp4:enterprise_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp4:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp4:terminal_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp5:enterprise_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp5:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp5:terminal_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp6:enterprise_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp6:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp6:terminal_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:enterprise_server:*:*:*:*:*
cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:server:*:*:*:*:*
EPSS
Процентиль: 89%
0.04454
Низкий
5 Medium
CVSS2
Дефекты
NVD-CWE-Other
Связанные уязвимости
github
почти 4 года назад
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.
EPSS
Процентиль: 89%
0.04454
Низкий
5 Medium
CVSS2
Дефекты
NVD-CWE-Other