Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
8.1
CVSSv3

CVE-2016-0376

Published: 03/06/2016 Updated: 12/09/2023
CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9
CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2
VMScore: 454
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Subscribe to Novell

Vulnerability Summary

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote malicious users to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.

Vulnerable Product Search on Vulmon Subscribe to Product

novell suse manager 2.1

novell suse linux enterprise server 11.0

novell suse manager proxy 2.1

novell suse linux enterprise server 12.0

novell suse linux enterprise module for legacy software 12

novell suse openstack cloud 5

novell suse linux enterprise software development kit 11.0

novell suse linux enterprise software development kit 12.0

ibm java sdk

redhat enterprise linux desktop 7.0

redhat enterprise linux workstation 7.0

redhat satellite 5.7

redhat enterprise linux hpc node supplementary 6.0

redhat enterprise linux server 7.0

redhat enterprise linux workstation 5.0

redhat enterprise linux server eus 7.2

redhat enterprise linux desktop 6.0

redhat enterprise linux server 6.0

redhat enterprise linux workstation 6.0

redhat enterprise linux desktop 5.0

redhat enterprise linux hpc node supplementary 7.0

redhat enterprise linux server eus 7.3

redhat enterprise linux server eus 7.4

redhat enterprise linux server eus 7.5

redhat satellite 5.6

redhat enterprise linux server eus 6.7

Vendor Advisories

Red Hat: Moderate: java-1.7.1-ibm security update
Synopsis Moderate: java-171-ibm security update Type/Severity Security Advisory: Moderate Topic An update for java-171-ibm is now available for Red HatSatellite 57 and Red Hat Satellite 56Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Sc ...
Red Hat: CVE-2016-0376
The comibmrmiioSunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (601625), 6 R1 before SR8 FP25 (61825), 7 before SR9 FP40 (70940), 7 R1 before SR3 FP40 (71340), and 8 before SR3 (8030) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers ...

References

NVD-CWE-Otherhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg1IX90171http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0702.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.htmlhttp://seclists.org/fulldisclosure/2016/Apr/43http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0701.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.htmlhttp://www.security-explorations.com/materials/SE-2012-01-IBM-5.pdfhttp://www-01.ibm.com/support/docview.wss?uid=swg21980826http://rhn.redhat.com/errata/RHSA-2016-0708.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0716.htmlhttps://access.redhat.com/errata/RHSA-2016:1430http://www.securityfocus.com/bid/89192http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.htmlhttp://www.securitytracker.com/id/1035953http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00067.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1039.htmlhttps://access.redhat.com/errata/RHSA-2017:1216http://www.securityfocus.com/archive/1/538066/100/100/threadedhttps://access.redhat.com/errata/RHSA-2017:1216https://nvd.nist.gov
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
hard-codedCVE-2024-27202NULL pointer dereferenceCVE-2024-28075CVE-2024-33608CVE-2024-28889CVE-2024-34572template injectionCVE-2024-34351
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook