The com.ibm.CORBA.iiop.ClientDelegate class in IBM Java 1.4.2 before 1.4.2 SR13-FP18, 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 improperly exposes the invoke method of the java.lang.reflect.Method class, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to the AccessController doPrivileged block.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ibm Aix | — | Apply the fix or workaround for java_april2016_advisory | Nov 30, 2017 | Jul 23, 2013 |
| Suse | — | Upgrade java-1_7_0-ibm-develUpgrade java-1_5_0-ibmUpgrade java-1_5_0-ibm-develUpgrade java-1_6_0-ibm-alsaUpgrade java-1_6_0-ibm-devel-32bitUpgrade java-1_4_2-ibmUpgrade java-1_5_0-ibm-64bitUpgrade java-1_5_0-ibm-fontsUpgrade java-1_5_0-ibm-devel-32bitUpgrade java-1_5_0-ibm-alsaUpgrade java-1_7_0-ibm-alsaUpgrade java-1_4_2-ibm-jdbcUpgrade java-1_5_0-ibm-pluginUpgrade java-1_6_0-ibm-64bitUpgrade java-1_7_0-ibm-pluginUpgrade java-1_5_0-ibm-alsa-32bitUpgrade java-1_5_0-ibm-srcUpgrade java-1_7_0-ibmUpgrade java-1_6_0-ibm-pluginUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_5_0-ibm-32bitUpgrade java-1_4_2-ibm-develUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_4_2-ibm-pluginUpgrade java-1_5_0-ibm-jdbcUpgrade java-1_6_0-ibm-alsa-32bitUpgrade sle-sdk-releaseUpgrade java-1_5_0-ibm-demoUpgrade java-1_6_0-ibm-32bitUpgrade java-1_6_0-ibm-plugin-32bitUpgrade java-1_6_0-ibm-develUpgrade java-1_6_0-ibmUpgrade java-1_6_0-ibm-fonts | Feb 17, 2015 | Jul 23, 2013 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub