1. Home
  2. CVE Database
  3. CVE-2012-5373
MEDIUM · 5.0

CVE-2012-5373

Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers ...

Vulnerability Description

Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm, a different vulnerability than CVE-2012-2739.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:N/I:N/A:P
Confidentiality
NONE
Integrity
NONE
Availability
PARTIAL

Affected Products

VendorProductVersions
OracleJdk<= 1.7.0
OracleJre<= 1.7.0
OracleOpenjdk<= 1.7.0

Related Weaknesses (CWE)

CWE-310

References

FAQ

What is CVE-2012-5373?

CVE-2012-5373 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers ...

How severe is CVE-2012-5373?

CVE-2012-5373 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2012-5373?

Check the references section above for vendor advisories and patch information. Affected products include: Oracle Jdk, Oracle Jre, Oracle Openjdk.