CVE-2016-0376

EPSS 5.7%
Veröffentlicht 03.06.2016 14:59:02
Zuletzt bearbeitet 06.05.2026 22:30:45
Erkennungen
Login

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 25

NVD 34 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Novell ≫ Suse Linux Enterprise Software Development Kit Version 11.0 Update sp4

Novell ≫ Suse Linux Enterprise Software Development Kit Version 12.0

Novell ≫ Suse Linux Enterprise Software Development Kit Version 12.0 Update sp1

Novell ≫ Suse Linux Enterprise Module For Legacy Software Version 12

Novell ≫ Suse Linux Enterprise Server Version 11.0 Update sp2 SwEdition ltss

Novell ≫ Suse Linux Enterprise Server Version 11.0 Update sp3 SwEdition ltss

Novell ≫ Suse Linux Enterprise Server Version 11.0 Update sp4

Novell ≫ Suse Linux Enterprise Server Version 12.0

Novell ≫ Suse Linux Enterprise Server Version 12.0 Update sp1

Novell ≫ Suse Manager Version 2.1

Novell ≫ Suse Manager Proxy Version 2.1

Novell ≫ Suse Openstack Cloud Version 5

Ibm ≫ Java Sdk SwEdition technology Version >= 6.0.0.0 < 6.0.16.25

Ibm ≫ Java Sdk SwEdition technology Version >= 6.1.0.0 < 6.1.8.25

Ibm ≫ Java Sdk SwEdition technology Version >= 7.0.0.0 < 7.0.9.40

Ibm ≫ Java Sdk SwEdition technology Version >= 7.1.0.0 < 7.1.3.40

Ibm ≫ Java Sdk SwEdition technology Version >= 8.0.0.0 < 8.0.3.0

Redhat ≫ Satellite Version 5.6

Redhat ≫ Satellite Version 5.7

Redhat ≫ Enterprise Linux Desktop Version 5.0

Redhat ≫ Enterprise Linux Desktop Version 6.0

Redhat ≫ Enterprise Linux Desktop Version 7.0

Redhat ≫ Enterprise Linux Hpc Node Supplementary Version 6.0

Redhat ≫ Enterprise Linux Hpc Node Supplementary Version 7.0

Redhat ≫ Enterprise Linux Server Version 6.0

Redhat ≫ Enterprise Linux Server Version 7.0

Redhat ≫ Enterprise Linux Server Eus Version 6.7

Redhat ≫ Enterprise Linux Server Eus Version 7.2

Redhat ≫ Enterprise Linux Server Eus Version 7.3

Redhat ≫ Enterprise Linux Server Eus Version 7.4

Redhat ≫ Enterprise Linux Server Eus Version 7.5

Redhat ≫ Enterprise Linux Workstation Version 5.0

Redhat ≫ Enterprise Linux Workstation Version 6.0

Redhat ≫ Enterprise Linux Workstation Version 7.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	5.7%	0.92

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.1	2.2	5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	5.1	4.9	6.4	AV:N/AC:H/Au:N/C:P/I:P/A:P

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://www.security-explorations.com/materials/SE-2012-01-IBM-5.pdf

Third Party Advisory

VDB Entry

https://access.redhat.com/errata/RHSA-2016:1430

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00067.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00002.html

Third Party Advisory

Mailing List

http://rhn.redhat.com/errata/RHSA-2016-0701.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0702.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0708.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0716.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1039.html

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1216

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21980826

Vendor Advisory

http://www.securitytracker.com/id/1035953

Third Party Advisory

VDB Entry

http://seclists.org/fulldisclosure/2016/Apr/43

Third Party Advisory

VDB Entry

Mailing List

http://www-01.ibm.com/support/docview.wss?uid=swg1IX90171

Vendor Advisory

http://www.securityfocus.com/archive/1/538066/100/100/threaded

Third Party Advisory

VDB Entry

http://www.securityfocus.com/bid/89192

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2016-0376

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-0376

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-0376

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2016-0376