The com.ibm.CORBA.iiop.ClientDelegate class in IBM Java 1.4.2 before 1.4.2 SR13-FP18, 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 improperly exposes the invoke method of the java.lang.reflect.Method class, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to the AccessController doPrivileged block.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ibm Aix | — | Apply the fix or workaround for java_april2016_advisory | Nov 30, 2017 | Jul 23, 2013 |
| Suse | — | Upgrade java-1_5_0-ibmUpgrade java-1_6_0-ibm-pluginUpgrade java-1_5_0-ibm-64bitUpgrade java-1_5_0-ibm-pluginUpgrade java-1_5_0-ibm-develUpgrade java-1_7_0-ibmUpgrade java-1_6_0-ibm-devel-32bitUpgrade java-1_7_0-ibm-pluginUpgrade java-1_7_0-ibm-develUpgrade java-1_5_0-ibm-devel-32bitUpgrade java-1_5_0-ibm-srcUpgrade java-1_5_0-ibm-alsa-32bitUpgrade java-1_4_2-ibmUpgrade java-1_7_0-ibm-alsaUpgrade java-1_6_0-ibm-alsaUpgrade java-1_6_0-ibm-64bitUpgrade java-1_5_0-ibm-alsaUpgrade java-1_5_0-ibm-fontsUpgrade java-1_4_2-ibm-jdbcUpgrade java-1_6_0-ibm-plugin-32bitUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_6_0-ibm-32bitUpgrade java-1_4_2-ibm-develUpgrade sle-sdk-releaseUpgrade java-1_6_0-ibm-fontsUpgrade java-1_6_0-ibmUpgrade java-1_4_2-ibm-pluginUpgrade java-1_5_0-ibm-jdbcUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_6_0-ibm-develUpgrade java-1_5_0-ibm-demoUpgrade java-1_6_0-ibm-alsa-32bitUpgrade java-1_5_0-ibm-32bit | Feb 17, 2015 | Jul 23, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub