The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ibm Aix | — | Apply the fix or workaround for java_advisoryApply the fix or workaround for java_april2016_advisory | Nov 30, 2017 | Nov 24, 2013 |
| Suse | — | Upgrade java-1_7_0-ibm-alsaUpgrade sle-sdk-releaseUpgrade java-1_6_0-ibm-pluginUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_6_0-ibm-fontsUpgrade java-1_6_0-ibm-alsaUpgrade java-1_7_0-ibm-pluginUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_7_0-ibmUpgrade java-1_6_0-ibm-alsa-32bitUpgrade java-1_7_0-ibm-develUpgrade java-1_6_0-ibm-plugin-32bitUpgrade java-1_6_0-ibm-develUpgrade java-1_6_0-ibm-devel-32bitUpgrade java-1_6_0-ibm-32bitUpgrade java-1_6_0-ibm | Feb 17, 2015 | Nov 24, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
